What do your passwords look like?

[Whitebear995]

I hope you mean the password to your vault, and not the same password you use over and over again.

I am old...I use the same password for everything. Using numerous passwords will having you forgetting and guessing at some point.

 

[AfricaHunting.com]

Hopefully this story will encourage everyone to review their internet security and to improve it if they need to.

@Wheels thank you for sharing your story here with us and I'm sorry that this has happened to you.

I hope also that you sharing your experience will prompt others to take action NOW and not wait any longer.

The two factor identification is a great advice.

Also some banks will allow you to set certain parameters so that the account holder will be notified via text as soon as a certain amount of money has left their account. Set the bar very low at for instance $1 and every time you use that credit or debit card/account to pay for something above that amount the bank will text and/or email you to let you know. This is another measure of protection but it does not prevent money leaving anyones bank account, just a good way to be made aware pretty much right away via text when a payment has taken place.

 

[Royal27]

I am old...I use the same password for everything. Using numerous passwords will having you forgetting and guessing at some point.

So one hack and you have the issue that @Wheels did. Your call of course, but you are not secure. Far from it.

Have a friend or family member help to set you up. It really isn't that difficult once you get started.

 

[AfricaHunting.com]

A special thanks to @sgt_zim for taking the time to educate all of us here on AH with this truly valuable information. Much appreciate you caring and wanting to help the people of our great community.

Thank you also to all who have contributed in this thread, sometimes a bad story will help one to realize the importance of taking action for their own best interest.

 

[Saul]

Great advice here from @sgt_zim. Everyone should read this and take their security very seriously.

 

[Wheels]

@Wheels thank you for sharing your story here with us and I'm sorry that this has happened to you.

I hope also that you sharing your experience will prompt others to take action NOW and not wait any longer.

The two factor identification is a great advice.

Also some banks will allow you to set certain parameters so that the account holder will be notified via text as soon as a certain amount of money has left their account. Set the bar very low at for instance $1 and every time you use that credit or debit card/account to pay for something above that amount the bank will text and/or email you to let you know. This is another measure of protection but it does not prevent money leaving anyones bank account, just a good way to be made aware pretty much right away via text when a payment has taken place.

AH has been attacked so many times. You are definitely an expert at this now.

You are doing a great job of keeping AH up. I never realized how much you deal with and still don't. This has certainly been a wake up for me.

 

[sgt_zim]

I am "the friend". Yes it is hard to believe that Royal has a friend, but we all pay our indulgences in different ways, mine is to be Royal's friend.

I used the same id and password for my email and three financial accounts. I knew that wasn't smart but I was lazy.

A group of hackers took control of a financial institution a few weeks ago. The website was down but the sign in page remained up. I tried to sign in multiple times. That is how the hackers got my id and password. The hackers then started randomly using the id and password on financial institutions and major companies throughout the world. That is how they got into my email and three financial institutions.

While on vacation, another financial institution started sending me texts for password resets. I contacted them to lock down my account. This happened multiple times. I am pretty sure the hackers removed all funds from my account. I had followed up diligently with the financial company and the company was remiss. A new account was established and funds placed into the account, so I am fine but this could have ended very differently. I probably had 50+ hours tied up in getting this worked out.

The original financial institution that was hacked helped in a big way once I was able to get past the initial two levels of gatekeepers/customer service, but hackers had gotten in and sold assets to cash and were trying to get the cash out of the account. I am fortunate the account was a retirement account so the sell didn't trigger a taxable event.

The third financial account was basically empty. I haven't messed with it.

I have had my email for 25-30 years. I noticed while on vacation that some of my emails had been read that I hadn't looked at. After a couple of days, I couldn't even get into my email account. I contacted ATT but they weren't real helpful. They have three questions I had to answer.

1. What is the email address?
2. What is the name on the account?
3. What is the zip code?

The hacker changed the name on the account, even though my name was part of the email address. He also changed the zip code.

I have had the same name all my life.
I have had the same email for over 25 years.
I have had the same physical address and ip address for over 25 years.
I have had the same zip code for over 25 years.

ATT should be able to confirm this, but ATT doesn't care. I talked to 34 people with ATT for 15-15.5 hours. Basically they are saying the email is no longer mine. All my contacts are gone. Communications with family members that held family history are lost since the family members are dead. Personal info, etc. Just think what you may have on your own emails from 25+ years ago when security wasn't as big a deal. You get the idea.

The hackers tried to gain control of my phone and change the sms. Thankfully this didn't happen or they would have had access to change all 2F identification.

2Factor identification is something I did right. If you don't use 2 Factor identification then you should definitely use it. If not for 2F or sms, I would have been out significant amounts of money, at least significant for me. Also whitelist financial accounts so funds have to age a couple of days prior to being removed.

My daughter is in town. She helped me set up a password vault. I now remember one password. The rest are auto generated. I should be in much better shape now than I was before. I only did the main accounts, not everything I log in for. If "Wheels" goes off on AH and starts spouting more nonsense than usual, then you will know my AH account has been hacked.

Hopefully this story will encourage everyone to review their internet security and to improve it if they need to.

@sgt_zim Now that I have a password vault, what happens if there is an emp? Do I need to keep a copy of the random generated passwords in a safe place somewhere or just trust that the password vault company is safe and will come back online when the rest of the internet gets back in service?

if we're blasted by an EMP, comms will be less reliable than they were before the Pony Express. You won't have to worry about all those accounts, because the data lines and servers where all that resides will be converted to blue smoke and ash.

 

[Wheels]

I am old...I use the same password for everything. Using numerous passwords will having you forgetting and guessing at some point.

You are me two months ago.

If you don't use a password vault, at least make sure the important accounts have different id's and passwords. Like sgt zim said. Make sure they are at least 15 digits long.

You can do something like combining:
First pet name
First address of home you owned
Symbol above 1 on American keyboard

You might then get a password like

Sparky4219SWVirginiaCir!

Then for next account use the second of all above. This is in no ways full proof but may help you to have a system for remembering the passwords.

 

[Wheels]

if we're blasted by an EMP, comms will be less reliable than they were before the Pony Express. You won't have to worry about all those accounts, because the data lines and servers where all that resides will be converted to blue smoke and ash.

That's what I was afraid of. Do you think the accounts will come back up with all the data backed up in a few years if an emp happens or do you think it is gone for good?

 

[sgt_zim]

I second the idea on Multi-Factor Authentication (MFA or 2FA). If you can get set up with Duo (I think you can still create a personal account with them for free), Duo push is the simplest and most straightforward to use. You try to log in to some site you're protecting with MFA, Duo pushes a notification to you your Duo cell phone app with "Y/N" response buttons. "Y" and you're in,. and "N" means you needs to change that account's password.

"YES" is a big green button, and "NO" is a big red button. Couldn't be easier.

Believe it or not, an MFA push like this is more secure than the vendor texting you One-Time Password (OTP) to enter onto their web page. If you can't use Duo for (https://duo.com) some reason, Google and MS both have "authenticator" apps which use rotating OTPs that change every 30 seconds or so. Also very secure.

Install the Google/MS authenticator, then go to the web site you want MFA for, and look for the "setting up mfa" link. Usually, your phone app just needs to take a snapshot of a 3D bar code presented by the web site for exactly this purpose. Very secure.

I end up paying for all the services I use because they always have features the free versions don't have, so I don't really know what's free anymore.

FWIW, I have Google and MS Authenticators for work and personal stuff, and for the stuff that's compatible, I used Duo (LastPass works with Duo for sure, that's how I get into my vault)

 

[BourbonTrail]

You are me two months ago.

If you don't use a password vault, at least make sure the important accounts have different id's and passwords. Like sgt zim said. Make sure they are at least 15 digits long.

You can do something like combining:
First pet name
First address of home you owned
Symbol above 1 on American keyboard

You might then get a password like

Sparky4219SWVirginiaCir!

Then for next account use the second of all above. This is in no ways full proof but may help you to have a system for remembering the passwords.

This systemic long form password is very handy.

I used to have to remember between 6-10 16+ character passwords for work. We couldn’t write them down or keep them in a password vault, and they had to be updated regularly.

This is what I used to help remember them all and it becomes quite second nature after a bit.

 

[Wheels]

I second the idea on Multi-Factor Authentication (MFA or 2FA). If you can get set up with Duo (I think you can still create a personal account with them for free), Duo push is the simplest and most straightforward to use. You try to log in to some site you're protecting with MFA, Duo pushes a notification to you your Duo cell phone app with "Y/N" response buttons. "Y" and you're in,. and "N" means you needs to change that account's password.

"YES" is a big green button, and "NO" is a big red button. Couldn't be easier.

Believe it or not, an MFA push like this is more secure than the vendor texting you One-Time Password (OTP) to enter onto their web page. If you can't use Duo for (https://duo.com) some reason, Google and MS both have "authenticator" apps which use rotating OTPs that change every 30 seconds or so. Also very secure.

Install the Google/MS authenticator, then go to the web site you want MFA for, and look for the "setting up mfa" link. Usually, your phone app just needs to take a snapshot of a 3D bar code presented by the web site for exactly this purpose. Very secure.

I end up paying for all the services I use because they always have features the free versions don't have, so I don't really know what's free anymore.

FWIW, I have Google and MS Authenticators for work and personal stuff, and for the stuff that's compatible, I used Duo (LastPass works with Duo for sure, that's how I get into my vault)

Great information and I agree. 2F saved my butt.

 

[sgt_zim]

That's what I was afraid of. Do you think the accounts will come back up with all the data backed up in a few years if an emp happens or do you think it is gone for good?

Gone for good, I would imagine. Depends on what kind of backups (magnetic tape is one kind, and is susceptible to EMP), and also where everything is stored. If it is stored underground or is otherwise enclosed within some sort of Farrady Cage, it would be. But no idea who, if anybody besides the USG, does that.