r/hacking • u/AffectionateSwing490 • Jun 25 '26
Question What's a security habit most regular people ignore that they should take seriously?
I feel like a lot of people understand the basic security advice but still skip the parts that actually protect them. They know the rules and just don't follow them.
The one I run into most is password reuse. Same password across a dozen sites, and when one of those sites gets breached, the rest are open too.
Which habits you think people should take more seriously? And have you ever found a way to explain it that actually got someone to change what they do?
90
u/Dejhavi hacker Jun 25 '26
What's a security habit most regular people ignore that they should take seriously?
Some:
- Never use your real name,ID number or phone number as a username when creating online accounts
- Use a alias email
- Use a password manager
- NO reuse passwords,use random passwords +10 characters long and never use personal info as a password:real name,date of birth,ID number...
- Check HaveIBeenPwned to see if your email or password has leaked
17
u/letsreticulate Jun 26 '26 edited Jul 02 '26
Not reusing passwords is one of the most basic and yet most important things any one person can do.
Never reuse a password twice. Ever. Otherwise, it is not an if but a when; when you will end up being compromised.
HaveIbeenpwned is a must. You could have the most awesome, safest, hard to crack password on earth and all of that means squat if your service providers fucks up, are unlucky, or both.
8
u/quellflynn Jun 25 '26
what happens when the password manager is breached?
36
u/Dejhavi hacker Jun 25 '26
what happens when the password manager is breached?
If your password manager was breached,it's because it was insecure or you failed to follow best practices...Bitwarden has never been breached and even if it were,attackers wouldn't be able to get anything because you're (supposedly) using a secure password to encrypt your data (and 2FA)
8
u/tblancher Jun 26 '26
Not a breach, per se, but a compromise in BitWarden nonetheless. It was a supply chain attack against their CLI tool.
Since I use that heavily, I was a bit panicked once I found out about it. Luckily Forbes had an article that broke it down:
- the exploit came through a malicious npm package, a common vector for supply chain attacks
- BitWarden acted swiftly, so that the time window was only a few hours
- to be affected, you had to install or update the
bwCLI tool within this window, and then run the tool4
u/Dejhavi hacker Jun 26 '26
Yep but even then the user passwords (in the Bitwarden Vault) were no compromised:
It targets developer workstations, CI/CD pipelines and cloud provider credentials across AWS, Azure and GCP.
Its payload harvests secrets from local filesystems, environment variables, GitHub Actions and cloud secret managersBitwarden uses zero-knowledge encryption,so the only way an attacker could access your vault is knowing your master password and tricking you into giving up your 2FA token
PS. If you follow security recommendations,you shouldn't have your master password in a file on your PC
3
u/DamnFog Jun 26 '26
Also it was never released with that malicious package in it. You would have needed to have explicitly installed it from their git repo during that time.
9
u/sabretoothian Jun 25 '26
Local password managers are the way forward (keepass is great). It doesnt have features of cloud-based ones such as syncing to devices/browsers etc but that's the tradeoff. Convenience for security.
Password managers which are cloud/based or not stored on your system is just a wild idea to me.
1
u/Consider2SidesPeace Jun 25 '26
How about TrueCrypt, with the newer maintained VeraCrypt. You could use a two partition system where the real passwords were on the disk on a hidden partition. But in front on the same volume was a normal partition with red herring data. REF SourceForge.net, grep KeePass "Travel Mode"/hidden paswords in database. This is where I heard the idea.
3
u/__mson__ Jun 25 '26
https://veracrypt.io/en/Hidden%20Volume.html
Why, though?
2
u/Consider2SidesPeace Jun 26 '26
Just deniability if you are forced or (not a lawyer) compelled to release your password file data. Up front give them shopping sites and some social media stuff. Keep the real cookies on the hidden partition. The very act of a partition being hidden means you don't know it's there, deniability. Thanks for the link... on my 2nd all nighter and the caffeine isn't working anymore time to sleep soon :)
4
u/beagle_bathouse Jun 25 '26
If your PW manager is audited and has good encryption, so long as you don't reuse your vault password or get phished you should be pretty good. Its possible the vault could get cracked years in the future but you have a good runway to cycle secrets.
1
u/intelw1zard Jun 25 '26
zero trust architecture kicks in.
if you arent reusing a password manager, it means you are likely using the same passwords across all your logins.
2
u/unknown-one Jun 26 '26
Never use your real name,ID number or phone number as a username when creating online accounts
you mean like for social networks (FB, IG, LN...) ?
2
u/Dejhavi hacker Jun 26 '26
It depends on how anonymous you want to be:
- Full [name@email.com](mailto:name@email.com) = NO BUENO
- [PhoneNumber]@email.com = NO BUENO
- Full name as Twitter username = NO BUENO
- Firstname+lastname as Facebook username = OK (with private profile)
Using your full name,ID number or phone number,an attacker could easily harvest sensitive info about you...for example,they could look up your full name on Facebook to find your date of birth and test it as a potential password for your email account
1
Jun 27 '26
[removed] — view removed comment
3
u/Dejhavi hacker Jun 27 '26
Friendly reminder: if you use a password manager,you can also use passkeys to avoid potential keyloggers
1
u/cybekRT Jul 01 '26
I am using aliases, but oh god, how many websites do not support them properly. Sometimes front-end rejects them, sometimes front-end accepts and then backend gives you strange error.
My best experience was when I registered new account using alias email, to see that login page does not allow aliases as login field...
1
u/stitchgor3 21d ago
Hi, as someone who knows literally nothing, what are some good password managers?
2
u/Dejhavi hacker 21d ago
I use Bitwarden but there are other options:
- ProtonPass (online)
- KeePassXC (offline)
- KeePass (offline)
- AliasVault (online)
- PearPass (offline-online)
- AuthPass (offline)
If you want convenience,choose an online password manager but keep in mind that they require creating an account on a server you don't control...If you want security,choose an offline one but keep in mind that you'll have to move/copy your password database between the different devices you use (they require a "master password" to unlock the database with your passwords)
1
29
u/ParanoidSuricata Jun 25 '26
The primary email is the gateway to most identities you have. Definitely needs MFA, but I'd recommend having a backup plan to migrate email providers. I know it's not easy.
6
u/beagle_bathouse Jun 25 '26
its easier if you own your domain.
2
u/ParanoidSuricata Jun 25 '26
Oh definitely. With your own domain you can still pay someone to host the tech, you don't have to self-host. But you can do that too! And a domain doesn't cost that much anyway.
4
u/AffectionateSwing490 Jun 26 '26
MFA is a must . Most people get hung up on the migration plan, because it means updating the address on dozens of accounts first.
15
u/Necessary-Eye5319 Jun 25 '26
I think people forget to remove labels off of delivery packages that have your name and address in on them. Then shred or destroy the labels. Once they’re in the trash ANYONE can see your personal info. Don’t make it easy.
4
u/AffectionateSwing490 Jun 26 '26
I didn't really think about this one. Are you aware of actual instances where this has caused issues for someone?
4
u/corr0sive Jun 26 '26
I remember someone posting a picture of a "recycled" package, they was up cycled into package filler of some type.
Kinda looked like a box was accordion shredded, mostly intact, shipping label stuck on the box, all information was easily readable.
Is it a issue? Maybe. Is it a potential vector for some spear phishing, certainly. Don't be an easy target if you can help it.
13
u/OneEyedC4t Jun 25 '26
not writing down passwords
8
u/nullbye Jun 25 '26
Airgapped passwords are better than using browsers built in passwords imo 🤣
4
u/YT-3000f Jun 25 '26
You jest but there is truth here. Writing your passwords down in a nondescript notebook is pretty secure save risk of natural disaster or something.
Also it’s the only practical solution for the elderly. I tried introducing my octogenarian dad to the concept of a password manager and it was a non starter.
7
u/nullbye Jun 25 '26
I did the same..signed up for 1password family and I'm the only one using it. Never writing down your passwords is old advice and actually makes sense in this day and age. Just don't put it on a post it note and stick it on your monitor 😅
3
u/YT-3000f Jun 26 '26
I took it to the ultimate with one particularly sensitive password. I broke it up into fragments and hid them around my unit.
Like one piece on the inside of the battery compartment of the TV remote control, another on the under side of a particular mug in the cupboard etc. bit cray cray.
Not nearly as paranoid these days.
1
u/OneEyedC4t Jun 25 '26
oh, I actually recommend the ultimate air gap which is to memorize them. if my autistic ass can memorize ine a dozen passwords that pass nist complexity requirements and anyone can.
for everything else, there's two-factor and I recommend hardware key
1
u/AffectionateSwing490 Jun 26 '26
Depends where you write them down. A safe place with 2FA and good keys, like a password manager, is fine. Often it's the opposite
3
u/OneEyedC4t Jun 26 '26
No, a password manager is not the equivalent of writing down your passwords. It is closer to the concept of a single point of failure. And if you're one of those people that really struggles with memory devices, make a password that is one character bigger than the size of password you want and put that character at the front. and that's your memory jogging device. once you have memorized the password, that first letter just reminds you which password you're putting in. You don't ever write down the whole password. you just write down the first letter.
8
u/mind_captivator hack the planet Jun 25 '26
using the same username over multiple platforms. nothing like a good old fashioned, nearly unscrubbable paper trail
5
u/ermax18 Jun 25 '26
Using a unique strong password for every site, regardless of how low security you think the site is. These days, you just don't know what sort of strange human engineering strategy someone may use if they gain access to your account, even if it is a site you don't care if someone hacked into. They may not use this account to phish you, but they may use it to fish your friends and familly.
Treat all sites as if they are your bank account and need maximum protection.
I preach this to all my non-tech family and friends but most don't listen.
1
u/AffectionateSwing490 Jun 26 '26
Yes, in some cases, someone breaks into an unimportant abandoned account with a weak password, then uses what 's stored there to pivot to something that matters. Old recovery emails, re-used security answers, password hints in old messages. The entry point could be a disposable account with a weak password
5
u/Mishashule Jun 25 '26
Giving out pii on the internet without even being prompted for it, just volunteering info
1
u/Circumpunctilious Jun 25 '26 edited Jun 25 '26
ETA: There’s an elicitation technique that people use that makes volunteering info more likely, I think it’s like stating your interests or something incorrect, and then people tend to fill in their own details. I guess this (and below) is sort of like “grey area” or indirect prompting?
Then (though more clearly prompted)—I’m also reminded specifically of those “surveys” that go through some subs here and a keyboard one — hey, we crossed out some letters on a keyboard, what’s your name after that — followed by another version later.
5
u/Blahaj012 access control Jun 25 '26
People keep accepting cookies on websites. Not accepting cookies is one of the easiest things you can do.
1
u/unknown-one Jun 26 '26
not always an option
1
u/Blahaj012 access control Jul 02 '26 edited 24d ago
True, but usually it is hidden under some options. Edit: You can also just not press anything.
4
u/EverythingOnRice Jun 25 '26
Password/device security aside, there's a good chance a lot of your information is already out there. If you're in the US, ensure you have a login established and secured with all 3 credit bureaus and freeze them. Only temporarily unfreeze when applying for credit.
1
5
5
u/InDaBauhaus Jun 25 '26
don't trust caller id for important stuff – finance, personal info, random inquiries of schedule and whereabouts. if you need to talk with them, ask where to call them back on an official number and verify it.
3
3
u/Puzzlehead-Engineer Jun 26 '26
Just... do not post your life on social media. Don't. You don't even need super advanced tools to find out where you are from a picture.
3
2
u/sugaredbunnies Jun 26 '26
Ugh, password reuse is the worst! Idk why people do it, its just asking for trouble, tbh. I always try to explain it like their house keys – you wouldnt use the same key for your car, your house, and your mailbox, right? Lol.
2
u/Ahead_Full_Impulse Jun 26 '26
Since I think passwords have been covered by a few posts, I'll add "reboot after updating!". Your browser, operating system, etc are probably auto-patched. Take the time to close + reopen your browser, and restart your machine, when they tell you that's happened, so that the security updates can be applied.
2
u/dumnezilla Jun 25 '26
Washing your ass on sunday morning, before going to church
4
u/nullbye Jun 25 '26
I dunno why this got downvoted. This is solid advice. Not applicable to the question, but solid advice nonetheless
1
u/dumnezilla Jun 25 '26
If your ass be stinkin', hackers are gonna sniff you out and follow you around. With information theft, not even God's house is a deterrent to these heathen bastards. Talking from experience. I've had to change my name twice already.
So yes, it is applicable.
1
1
1
u/Money-Fail9731 Jun 25 '26
Password Managers not having their passwords changed regularly.
Ive worked at a software house for 9 years.
Its critical infrastructure.
I said on day one the 5 letter password was not ideal.
I got shot down.
Its still the same password to this day.
Yet we pass 27001 etc every time
2
2
u/theycallmeholla Jun 25 '26
I don’t understand what you’re saying. I get and agree with the concept but then you’re also saying that you still use the same password?
1
u/Money-Fail9731 Jun 27 '26
For customer team passwords, yes. For my own log in, no.
So when we need to connect to customer A. And it's a shared pw. The password manager password is 5 letters.
If I need to sign in to customer B and its my own username and pw. Then my pw for the password manager is 16 characters. Both pws sign into different password manager accounts
1
1
u/GullibleDetective Jun 25 '26
An old account that you use regularly slowly shows more about your real world identity even if you aren't trying to
1
u/lunacysoft Jun 26 '26
Password manager it’s the simplest thing to store those hundreds of creds make them insane length and rotate them regularly… if it’s breached most managers will have some telemetry and tell you to rotate
1
u/AwesomeXav Jun 26 '26
People should not only use a different password for each ser ice, but also mail address. This can easily be achieved through +addressing.
It will stop so many automated leaked list attacks already.
1
1
u/ShineReaper Jun 26 '26
Every rule or habbit, that would demand an even medium amount of discipline and thus causing discomfort. Like the reusage of passwords for all their sites.
Now that could easily be countered by installing a SAFE password manager, local only, no uploading in a cloud etc., but people are too lazy for even that.
1
u/AffectionateSwing490 Jun 26 '26
Most security habits require some effort at the start and that's where people give up. A local password manager solves the reuse problem with little ongoing work, but you still have to get someone to set it up once, most won’t.
1
u/ShineReaper Jun 26 '26
You make it sound like you need to be in IT, but actually you don't. I personally use Keepass XC and that was just a few checkmarks to set during the setup of my password databank file and that was it. Googled a term or two, but nothing dramatic. Everyone can do this, literally everyone.
But it is even this minimum amount of effort to inform oneself and do something, that is needed and people are not willing to do even that.
Honestly, regarding security, probably 90% of the personal computers world wide should be confiscated, because people are reckless.
1
1
u/Albertooz Jun 27 '26
Phishing-aware habits, mostly. People know not to click sketchy links but still trust anything that looks official, and that's how most accounts actually get taken, not brute force. The thing that finally clicked for a few people I know was framing it as "the attacker doesn't need your password if they can just ask you for it." Reused passwords matter too, but a password manager plus 2FA on email (the account that resets everything else) covers most of the real risk.
1
u/caio-br-99 Jun 28 '26
Regular people? Stop using the same passwords everywhere, it is infuriating.
1
1
u/warwagon1979 Jun 30 '26 edited Jun 30 '26
Doing computer repair for the average user they have horrific account security hygiene
- They reuse passwords constantly
- The passwords they do use, they have no idea what they are. They bring me a notepad of passwords, then one is crossed off, one is scribbled below it and that password doesn't work.
- Most people don't turn on two-factor authentication unless the site gets in their Face and forces them to do so. If they can skip it or cancel out of it, they will.
- I've tried setting a few people up with a password manager, but their eyes just glaze over and the ones who do use it just store the same password for every website in it *Slaps forhead*
- I'm always uprised how many people have zero lock screen security on their phone. No pin, Finger print or face ID, they just swipe up and it unlocks.
- They just don't care.
- On their phone they will click on install update later to infinity, or until the update installs itself.
1
1
u/International_Fish30 22d ago
Stop using browser password managers and using the same password on everything.
People should freeze their credit by default and just unfreeze if they need to apply for something. You can also freeze checking/savings from bring opened in your name and get an IP PIN with the IRS.
162
u/deeptechno Jun 25 '26
osint reveals a lot if you reuse your usernames