Post by @markwyner@mas.to

2026-10-17 06:47 UTC

Y’all! Please, please, please use appropriate passwords. We’re seeing a big spam campaign across the fediverse, using hacked accounts. First, change your fediverse password. Especially if it’s reused elsewhere, short/weak, or really old. Then, here are some simple steps to protect you and your accounts: 1. Never reuse passwords. Use a password manager so you’ll only have to remember one password. 2. Make sure your passwords are secure. They should be 12+ characters with at least one capital letter and one special character. Good password managers have a generator built-in. 3. Set-up multi-factor authentication (MFA/2FA). 4. Use passkeys wherever possible. If you need help, ask someone. Folks who know will help. #Passwords #Security #InfoSec #OpSec #2FA #MFA #Mastodon #Fediverse #FediTips #MastodonTips

Replies (1)

@ErikvanStraten@todon.nl 2026-10-17 08:24

@markwyner@mas.to : in addition, — At least on Android and iOS/iPadOS devices, configure your OS and password manager to use AutoFill. This helps prevent phishing via fake websites (often using a slightly different domain name, while the login page looks identical to the one on the real website). See the screenshot below (additional details in the Alt text). — Important: when using AutoFill, if no credentials pop up from your password manager, don't start looking in the database itself like Troy Hunt did by mistake (https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/). — Make a backup of your password manager database after each change. Preferable have multiple backups, at least one offline. — Configure your browser to always warn for http (instead of https) connections. — When using unique strong passwords, don't use weak 2FA/MFA. The advantage is negligeable while the risk of account lockout (caused by loss of the second factor) is huge. In particular TOTP sucks; most "Authenticator" apps are insecure privacy-risky stupid password managers without phishing resistance. More info in https://todon.nl/@ErikvanStraten/115611078608008423. #AutoFill #PasswordManager #StrongPasswords #2FA #MFA #TOTP #WeakMFA #Weak2FA

Open ##5078909