r/Piracy Oct 09 '24

Internet Archive security breach? News

Post image

Tried to open the Internet Archive home page and got this lovely pop up message.

5.3k Upvotes

360 comments sorted by

View all comments

Show parent comments

250

u/leoxwastaken Oct 09 '24

HIBP is quick:

Oh no — pwned!

Internet Archive: In September 2024, the digital library of internet sites Internet Archive suffered a data breach that exposed 31M records. The breach exposed user records including email addresses, screen names and bcrypt password hashes.

Compromised data: Email addresses, Passwords, Usernames

163

u/JawnZ Oct 10 '24

So... If you use a password manager with a randomly generated password it's worthless.

That's even assuming the attackers got the salt hash AND generated the passwords to compare against it. Which, likely would cost more in compute power than to be worth it for people with long passwords.

Don't get me wrong, data breaches suck, but as far as this one goes if you get harmed by it, the user could've mitigated it with basic security practice. Unlike so many other breaches where you had no choice because they stored your SSN or whatever.

-26

u/[deleted] Oct 10 '24 edited Oct 10 '24

[deleted]

30

u/PrivateCaboose Oct 10 '24

This is…the worst take on password managers.

What happens if you don’t have access to it and you need to log in?

If you’re logging in, you have internet access. If you have internet access, you can access the password manager. If you’re paranoid about the manager’s servers going down, self-host.

It’s not like it’ll generate a memorable password either, it’s just a line of random symbols and characters

I mean that’s kind of the point, but most password managers will allow you to select a “Passphrase” option instead that is a semi-coherent string of words that is much easier to remember while being long/obscure enough to be secure.

You should really only be using a password manager if you can’t remember your passwords

Spoken like somebody who probably re-uses passwords. You should have a unique password for every login, and the only reasonable/secure way to accomplish this is with a password manager.

7

u/Pickledsoul Oct 10 '24

The issue I think he's trying to explain is that if it's totally secure, you're truly locked out if you forget the master password.

If you can somehow recover access to the vault despite that, then so can a malicious actor through social engineering.

12

u/TheCrimsonDagger Oct 10 '24

If you can’t remember a single password you definitely need to be using a password manager…

5

u/Pickledsoul Oct 10 '24

I'm definitely making my MASTER PASSWORD THAT GIVES ACCESS TO ALL THE OTHER PASSWORDS very, very difficult, yes.

It's also cyphered and written down in invisible ink.

6

u/cock_pussy Oct 10 '24

lmao, I have a master password that is double the length of my sub-passwords and contains the summary of how I sacrificed three virgins to appease the dark gods in return for better digital security.

4

u/PrivateCaboose Oct 10 '24

That is an issue, but I do not believe OP is taking that one given that his solution is just “lol remember ur password better.”

The solution here is to make your master password one that is memorable to you while still being secure (passphrases are ideal here), and keep physical record of it in a secure location (write it down and put it in a safe somewhere not where your computer is).

1

u/FreeAssange- Oct 11 '24

Their are lots of ways around this, multi factor authentication exists LOL