Secure Your Most Important Accounts

[@askleonotenboom]

✅ Watch next ▶ Why Password Managers Are [Still] Safer than the Alternatives ▶ kzbin.info/www/bejne/npCWaIuCm9R7mdE

[@cjc363636]

Thanks, Leo! 2FA is a must for ordinary net citizens these days. And the mobile PIN code. My carrier now supports that, and I set it up.

[@wingshockeyfan]

Thank you Leo, I really enjoy content that has to do with security and money.

[@RCohle452]

In Australia it is mandatory for mobile providers to make you generate a pin

[@groove9tube]

This can get complicated when under attack. Someone tried to steal my cell phone number, and had full access to my carrier account. I had to cancel my account and get a new phone number under a relative’s name. Happened so fast I could not update web accounts prior to new number and some wanted to do 2FA with old number to log on, and there was no phone support. That’s one of the flaws in the mobile phone based 2FA system.

[@starkwedder9787]

What about passkeys? If they are more secure as they say, why they do not spread fast?

[@WikingiHori]

If I didn’t login to your account, and your bank says you did, how can you get help with this matter or issue.

[@randyduke6601]

Just recently the FBI issued a warning that due to a Chinese attack on mobile phone carriers text messages may not be private, how does this effect those of us who uses SMS as a means of 2FA?

[@askleonotenboom]

The other part of that announcement was that "very few people are affected". So I don't see it as an issue for most of us. On the other hand, if you're in government (which they were targeting), or other valuable targets, then you may want to check into alternatives.

[@Damariobros]

SMS 2fa was always insecure anyways because of SIM Swapping. SIM Swapping is when a malicious actor either impersonates you or pays off someone in the mobile carrier company, in order to get your SIM card deactivated and a new one sent to them with your phone number. That malicious actor can then receive your 2fa codes. I encourage you to avoid SMS 2fa whenever possible, and to use more secure alternatives like security keys, authenticator apps, and passkeys, with a set of backup codes or a recovery key as backup. If those aren't available, use email 2fa. SMS should only be used if it is the only option available, or if they do not allow you to activate other forms of 2fa without having SMS as an enabled method.

[@jamesgerboc]

My family and I have been extremely sensitive to this topic and diligent about security. Yet, one of the 3 big credit Bureaus and my retirement manager CBIZ were hacked last year and ALL of our sensitive and private information is now out there. I look at things like this now and ask, why bother?

[@gtm5650]

Hi Leo which antivirus app would you recommend for Pixel phone? Thanks

[@askleonotenboom]

I generally don't recommend one (didn't need one for the longest time, and haven't done the research). That being said I run BitDefender on my Pixel 6.

[@IBVideo-hdl]

If someone misspell a recovery email address for a google account, of which is not confirmed to be used as recovery by the owner of that address, but later is removed from being an address for recovery. Could that google account still be compromised through the misspell email even though already removed ? (Probably not by its true owner but if that email was compromised first)

[@askleonotenboom]

If it's been removed, no.

[@chrisross1703]

NCSC recommends passwords made up of three random words (lower case, no special characters).

[@kersi-sandiego6036]

Password manager, 2FA.

[@bme7491]

Almost no bank supports hardware 2FA.

[@zetectic7968]

@@bme7491 move your account to a bank with better security.

[@jamesedwards3923]

@@bme7491 There is one. It is just a pain to install and remove. I know, because I've done both.

[@jamesedwards3923]

@@bme7491 Some do, most don't.

[@glasslinger]

Paypal, ebay, Amazon, the bank, the credit card, and google login: (very important!) This "long" password idea seems obsolete with password handlers that now lock you out after a few bad tries.

[@NoEgg4u]

'This "long" password idea seems obsolete with password handlers that now lock you out after a few bad tries.' Whose handlers? Who locks you out?

[@zetectic7968]

Your comment makes no sense unless you refuse to use a password manager. By using a password manager you don't get bad tries.

[@glasslinger]

@@NoEgg4u The bank, paypal, ebay, and most others that have the capability to lose money.

[@glasslinger]

@@zetectic7968 How do I set the password manager to hack someone's account? HACKERS are who try many passwords to hack into someone's account. I would like cheese on my burger.

[@jamesedwards3923]

I do not know pretty much all my passwords. Frankly, in my discussions online and offline. Most users are just lazy. Pure and simple. The next thing you must ask yourself is simple. 'Do you really need to know your passwords?' The answer is, no you do not. I do not need to know my bank passwords. Nor most of my emails. My Netflix. Nor my Uber or Lyft. My router passwords; including my Admin. I have no idea what they are. So that makes me harder to hack. Not impossible. Just harder. Let me be blunt. The bad guys target the ignorant, lazy, weak, and careless. They also target people worth the effort. For example. If you do a search on Google right now. A lot of these 'Tourist Visa' organized crime rings. Are not targeting an 'Urban' environment. Why, common sense and demographics. When poorer people tend to have better physical security, more inclined to fight, and have less expensive stuff. Why would they rob them? On the other hand 'other' metrics dictate. That if someone lives in a house made of glass. Have attractive mates. And wear watches. Worth high five to six figures - Whom do you risk a hefty prison sentence for? The harder it is for a bad guy to brute force your hashes. The more 2F you have. The harder you are a target. Combined with the lower you are on social-economic and 'metric' dynamic. The less likely they are to target you. With any real effort.