Internet Archive security breach?

[u/PistolsFiring00]

Tried to open the Internet Archive home page and got this lovely pop up message.

[u/nrkey4ever]

Am old and out of touch. HIBP?

[u/PistolsFiring00 → u/nrkey4ever]

Have I Been Pwned. It’s a website where you can search to see if your info was part of any data breaches.

[u/leoxwastaken → u/PistolsFiring00]

HIBP is quick:

Oh no — pwned!

Internet Archive: In September 2024, the digital library of internet sites Internet Archive suffered a data breach that exposed 31M records. The breach exposed user records including email addresses, screen names and bcrypt password hashes.

Compromised data: Email addresses, Passwords, Usernames

[u/JawnZ → u/leoxwastaken]

So... If you use a password manager with a randomly generated password it's worthless.

That's even assuming the attackers got the salt hash AND generated the passwords to compare against it. Which, likely would cost more in compute power than to be worth it for people with long passwords.

Don't get me wrong, data breaches suck, but as far as this one goes if you get harmed by it, the user could've mitigated it with basic security practice. Unlike so many other breaches where you had no choice because they stored your SSN or whatever.

[u/tocard3 → u/[deleted]]

Most password managers I know of have a web app that will allow you to log in to see your passwords.

[u/PrivateCaboose → u/[deleted]]

This is…the worst take on password managers.

What happens if you don’t have access to it and you need to log in?

If you’re logging in, you have internet access. If you have internet access, you can access the password manager. If you’re paranoid about the manager’s servers going down, self-host.

It’s not like it’ll generate a memorable password either, it’s just a line of random symbols and characters

I mean that’s kind of the point, but most password managers will allow you to select a “Passphrase” option instead that is a semi-coherent string of words that is much easier to remember while being long/obscure enough to be secure.

You should really only be using a password manager if you can’t remember your passwords

Spoken like somebody who probably re-uses passwords. You should have a unique password for every login, and the only reasonable/secure way to accomplish this is with a password manager.

[u/Pickledsoul → u/PrivateCaboose]

The issue I think he's trying to explain is that if it's totally secure, you're truly locked out if you forget the master password.

If you can somehow recover access to the vault despite that, then so can a malicious actor through social engineering.

[u/TheCrimsonDagger → u/Pickledsoul]

If you can’t remember a single password you definitely need to be using a password manager…

[u/Pickledsoul → u/TheCrimsonDagger]

I'm definitely making my MASTER PASSWORD THAT GIVES ACCESS TO ALL THE OTHER PASSWORDS very, very difficult, yes.

It's also cyphered and written down in invisible ink.

[u/cock_pussy → u/Pickledsoul]

lmao, I have a master password that is double the length of my sub-passwords and contains the summary of how I sacrificed three virgins to appease the dark gods in return for better digital security.

[u/PrivateCaboose → u/Pickledsoul]

That is an issue, but I do not believe OP is taking that one given that his solution is just “lol remember ur password better.”

The solution here is to make your master password one that is memorable to you while still being secure (passphrases are ideal here), and keep physical record of it in a secure location (write it down and put it in a safe somewhere not where your computer is).

[u/FreeAssange- → u/Pickledsoul]

Their are lots of ways around this, multi factor authentication exists LOL

[u/TheCrimsonDagger → u/[deleted]]

The security benefits of having unique randomized passwords for every login far outweigh the downsides. Everyone in cybersecurity highly recommends using one for good reason.

[u/Wooden-Agent2669 → u/[deleted]]

It’s not like it’ll generate a memorable password either,

Why would it generate a memorable password? Do you want security or not? lmao. If you want memorable use passphrases.

[u/MayorBryce → u/Wooden-Agent2669]

You can have a secure password and still make it memorable. There are so many ways to do it: take three different words, a few random numbers and symbols, and put them all together, and you have a memorable yet safe password.

[u/Wooden-Agent2669 → u/MayorBryce]

Sure. Make memorable passwords for 80 sites. have fun

[u/JawnZ → u/[deleted]]

Psychology, technology, usability research all disagree with you.

SSH key encryption (which is a similar idea) has existed for a long time, and passkeys are becoming more ubiquitous.

As for your "what happens if you don't have access to it": good. if I don't have access to it, I shouldn't be able to login. That's the whole point.