c/cybersecurity-tips

Showerthought: I used to just use the same password for everything until last year

I finally switched to a password manager after my email got hacked in July, and now I don't even remember what my old Netflix login was. Has anyone else had trouble getting family members to actually use those things?

Finally got my parents to use a password manager after years of them writing everything on sticky notes

My dad kept using the same 4-digit PIN for everything including his bank. After he got phished on a fake Netflix email last month, I showed him Bitwarden and he actually switched. Anyone else have luck getting older relatives to stop using "password123"?

Hit 30 free trials in one month and that felt like a huge red flag

I signed up for 30 different free trials last month just to test some password managers and VPNs, and the sheer number of subscription traps honestly shocked me. Has anyone else noticed these trials are getting way harder to cancel than they were a year ago?

Saw a guy at Starbucks using public WiFi for banking

Was grabbing coffee downtown last week and this dude next to me logs into his bank app on the Starbucks WiFi. No VPN, no nothing. I almost said something but didn't want to be nosy. Public WiFi is wide open for packet sniffing. Has anyone here ever seen someone get hit by that?

Used to click every link in phishing test emails at work. Got caught 3 times before I wised up.

Been working at a mid size company in Cleveland for about 2 years now. First 6 months I kept failing those fake phishing tests they send out. Clicked on "free pizza day" links, filled in my login on fake Office 365 pages, the whole deal. Got called into HR after the third fail. Now I hover over every link before clicking and check the sender email like a hawk. Last test they ran I was the only one in my department who spotted it. But honestly how come nobody teaches this stuff in onboarding? You just get thrown into the deep end. Any of yall had to learn cybersecurity the hard way too?

Saw a sysadmin replace a dead hard drive without powering down the server and I called him reckless but that hot swap trick saved us 4 hours of downtime on a Friday.

My uncle Pete who ran IT for a school district told me hot swapping drives was asking for data corruption, but when we lost a drive mid-batch job last Tuesday, swapping it live kept everything running and the rebuild finished in 45 minutes without a single error, so has anyone else had that old school advice just not hold up under real pressure?

Finally patched that old router I forgot about

Was at my parents' house in Phoenix last weekend helping with their wifi. Found an ancient Linksys router in the closet still plugged in. Checked the admin panel - firmware from 2016. Logged in and updated it in 10 minutes. Now their whole network feels faster. Has anyone else found old hardware running somewhere you'd least expect?

My password manager paid off big time after a breach scare last month

I've been using Bitwarden for about 18 months now, just for convenience really. Then my email got leaked in one of those big data breaches (the 2021 LinkedIn one apparently). I checked haveibeenpwned and saw it matched. Instead of panicking, I just ran the 'security report' feature in Bitwarden and found 12 sites where I'd reused that same password. Changed every single one in under an hour. Has anyone else had a moment where their password manager actually saved them from something real?

Hit 500 unique passwords in my password manager yesterday and that's when it got real

I figured I'd maybe have 100 or so accounts but turns out every random forum, free trial, and newsletter signup adds up fast, so how many passwords are you guys sitting on?

Got roasted on a forum for using "Password123" and it finally clicked

Some dude on r/cybersecurity called me out 2 years ago for having the worst password habits. Said I was basically inviting hackers to my front door. Made me switch to a password manager and set up 2FA on everything. Now I use 16 char random passwords and sleep way better. Anyone else get shamed into better security habits?

Can we talk about those password manager ads?

I brushed them off for like 3 years thinking it was just another subscription trap. Then my buddy had his email taken over last summer and I finally tried Bitwarden for $10 a year. Anyone else do a complete 180 on something they thought was overhyped?

Got roasted in a code review for using the same password on 3 test accounts

Last week my senior dev pulled me aside after a security audit and said "dude, your test DB passwords are all the same thing." I felt like an idiot because I just copied and pasted the same credential for three different environments without thinking. She made me watch her generate unique 20-character strings for each one and store them in a vault. Now I use a password manager even for my dummy accounts and honestly it feels way more professional. Has anyone else gotten called out for lazy password habits?

My Aunt's 'password is your dog's name' advice finally clicked after 3 breaches

I was talking to my aunt last week about how she keeps getting hacked, and she told me she uses her dog's name with the year after it for everything. She said she's never had an issue, but I pulled up a stat showing 80% of breaches use info from social media. Have you guys ever convinced a family member to switch to a password manager or just given up?

Found out 95% of data breaches start with phishing emails, not some hacker genius

I was reading the Verizon DBIR report last week and that stat really hit me. All this time I thought the big threats were these super skilled hackers breaking into systems. But nope, it is just people clicking links they should not. Makes me wonder how many of us actually run phishing tests on our own accounts or do those mock email drills.

Found out the hard way that using the same password for 12 accounts is asking for trouble after my email got hijacked last Tuesday

Took me 6 hours to reset everything and I'm still finding accounts I missed - has anyone else dealt with this nightmare after a breach?

DAE think password managers are overrated? Had a nightmare scenario last week

So my password manager (Bitwarden) just locked me out without warning. I was trying to log into my bank account on my phone and it needed my master password again even though I had the app set to stay logged in. Ended up locked out of everything for like 4 hours trying to reset through email verification which was a whole other mess. On one hand it's great having all those random passwords and not reusing them everywhere. But on the other hand if that one master password fails or the service goes down you're totally stuck. Has anyone else had a similar lockout or am I just the unlucky one?

Overheard a kid say "passwords are for boomers" and it hit me different

I was at a coffee shop in Portland last week and this teenager told his friend he uses the same 6 digit pin for everything because "hackers don't care about my stuff." Made me realize how much the younger generation just expects security to be invisible now, like we didn't spend years memorizing different passwords for every account. Anyone else notice this shift with people under 20?

Shoutout to the guy who warned me about public Wi-Fi at coffee shops

I always rolled my eyes when people said not to use public Wi-Fi for banking. Then last month I logged onto the guest network at a Starbucks in Phoenix and got a fake login page that looked exactly like my bank's site. Close call. Anyone else seen these fake login pages popping up?

Used to think password managers were overkill until I got hit with a $300 fraud charge

My brother kept pushing Bitwarden on me for months and I brushed him off. Then someone got into my email last month and drained my PayPal before I caught it. Has anyone else had to deal with chargebacks after something like this?

Got my personal info stolen after using the free wifi at a coffee shop in Austin

Unpopular opinion: password managers are actually a huge risk in my opinion

I spent 3 days locked out of my own bank account after my password manager glitched during an update and corrupted my vault, has anyone else had a recovery nightmare like that?

Woke up to a ransom note on my desktop yesterday, actually felt sick for a minute

I clicked a link in an email I thought was from my bank. By the time I realized it was off, my files were locked and there was a popup demanding $500 in bitcoin. I immediately unplugged the ethernet cable and ran a full scan with Malwarebytes, which caught some shady process I'd never seen before. Luckily I had a backup from two days ago on an external drive so I only lost a few small files. Has anyone else had a close call like this with a fake login page?

My IT buddy told me to use the same password for everything and I almost lost my email account

So my friend Mike who works in IT told me it was fine to reuse passwords as long as I had a good antivirus. I trusted him because he fixes computers for a living lol. Last month I got a notification that someone logged into my email from a random IP in Nigeria. Turns out a site I used got hacked and they had my password. The hacker tried to reset my bank password through my email and I caught it just in time. I spent like 3 hours changing passwords and setting up two factor authentication on everything. Has anyone else gotten bad advice from someone who should know better?

Hit 500 failed login attempts on my home server in one week

Checked my fail2ban logs last night and saw 500 blocked attempts from a single IP in Boston trying to brute force my SSH. That was way more than I expected from a random home setup. Has anyone else seen that many hits on a non-business network?

How a 2-factor auth change saved my account in 48 hours

Honestly, I used to think 2-factor authentication was just a hassle. I had it set up with SMS codes and figured that was good enough. Then last Tuesday, I got a weird text from my bank about a login attempt in a city I've never been to, Austin. I ignored it at first, but then my email started getting flooded with password reset requests. Turns out, someone had my password from a data breach years ago. I switched my 2FA to an authenticator app that same day, and within 48 hours, the phishing attempts completely stopped. The app generates codes locally, so hackers can't intercept them like SMS. Has anyone else noticed a difference after ditching SMS codes for an authenticator app?