1Password announces breach

1698271612092.png

requires a physical breach ;)
 
pendragon1 said:
View attachment 608852
requires a physical breach ;)
Click to expand...
I have a white board, it was here when I started the job and it had a smattering of passwords written on it, and I am told that the guy I replaced (I never met them) got that whiteboard from the guy he replaced. Nothing as far as I can tell has ever been removed and there is no context to any of them, its just a board of random passwords to god only knows what.
 
KeePassXC, just remember that one master password and have many copies of the .kdbx file. I have even abandoned Authy, and just use the TOTP functions in KeePassXC. Only an all drive disaster or memory lapse on my part will breach my passwords.
 
Last edited:
Depends on the site, I think. I got back into my Y! account after years, but can't get into my actual YouTube account that was based on my Y! account before Google acquired YT.

And I know the PW for YT - they are just forcing 2FA for an account that hasn't been used in a while, and won't let me in (linked to an old phone #).

-bZj
 
t1337duder said:
I'm curious how useful these breaches are with 2FA being so common these days.
Click to expand...
I mean from what they said about it, the attackers didn't get anything. This is just a responsible disclosure kind of thing, not a "your info got breached" thing.
 
t1337duder said:
I'm curious how useful these breaches are with 2FA being so common these days.
Click to expand...

If it isn't mandatory, people will skip it.

In the context of 1Password, they didn't get anything that would help attack any of these accounts. Even if they got your entire vault, and your password in plain text, they still couldn't decrypt it. They couldn't even log into your account even without MFA because they need to provide the secret key... and you have the only copy of it.

And it's basically random, so there's so much guaranteed entropy that it's impossible to attack, unlike a password.

At that point I guess if they can't hijack your login session _somehow_ or compromise your machine, someone will just come beat the key location out of you with a pipe wrench.
 
You must log in or register to reply here.
Back
Top