Notecabin ftw, an app made by my dad. Basically a less complete but more secure form of Zoho's apps
Password management methods? I was Hax0red like a bitch...
- Thread starter Fatbat
- Start date
+ 1 for Roboform. Costs $30 ($20ish if you fuck around finding a coupon code) but it's well worth it.
Dittoooooooo on roboform. Paid 25-30 or so for it like... 3-4 years ago. probably have 500 passwords stored on it. Fucking lifesaver.
Well, I wasn't going to go into it, but gather 'round children and let me tell you a tale of unspeakable horror...
On Friday I visited a Thematic WP child theme site in Firefox and had a script run on me that called on files from a .ru site. It walked right past my AVG, launched some Java, and shut down my firewall and about 10 seconds later I had about 130 trojans and whatnot on my machine.
Spent a couple hours cleaning house and thought the coast was clear. Ran fine all weekend thinking everything was good until, to my shock and horror, I got a phone call Monday morning from a client telling me their site on my server was spawning the same sort of shit.
Came to reallize that my main workstation was rooted and that they had gotten their hands on some cached FTP data and had modified 8 different sites on my server.
It gets better though! My home box had been used to send Viagra spam all weekend and I had a bunch of angry letters from my ISP on Monday telling me to knock it off or else. LuLz all around.
Sooo, out with AVG and Malwarebytes because not only did they fail to stop the infection from casual browsing of the web, they failed to find it after the fact. In with Kaspersky and Prevx. Starting to really question Firefox as well.
Had to reformat my home machine and so I upgraded from XP to Win7 as well... seemed like a good opportunity to do that. Spent the next couple of days changing passwords on everything, cleaning the server and rebuilding my workstation.
So, yeah, don't I feel like a total douche. Easily one of the worst days of my life. I was nearly sick from the stress.
Gonna give KeePass a try for server management and maybe Roboform as well for browser management. Thanks for the recommendations folks!
Stop using FTP and use SCP with password-protected key files instead. You can have one key per server, or one key for one user on all servers, or any combination you fancy. Added bonus is that because it all goes through SSH, you can login nice and easily as well.
Oh, and you don't *have* to use passwords, but it's highly recommended
Oh, and you don't *have* to use passwords, but it's highly recommended
Yeah, no more regular FTP either. It was a case of "I don't know what all those guys are talking about, nothing bad has ever happened...".
Yup.
Yup.
Never use an online password manager to keep your sensible data, every system can be hacked.
1) KeePass:
Protect the application db with a robust password and generate the random passwords with KeePass (at least 20 chars and use special characters whenever you can).
Benefits: it's free and secure, it's awesome and portable, keep it on a USB drive.
2) iMacros plugins for FF and IE:
In the Options -> Security section, encrypt your passwords with a master password.
Benefits: Free, fast and secure
1) KeePass:
Protect the application db with a robust password and generate the random passwords with KeePass (at least 20 chars and use special characters whenever you can).
Benefits: it's free and secure, it's awesome and portable, keep it on a USB drive.
2) iMacros plugins for FF and IE:
In the Options -> Security section, encrypt your passwords with a master password.
Benefits: Free, fast and secure
This. Works on all platforms. Passwords are stored in an encrypted file (your choice of AES, DES, Blowfish). Just back up that one file and all your passwords are safe.
+++++1 for keepass
I store the key file in my dropbox folder which enables access to it anywhere. just be careful where you enter that 20 character master password. I use a combination of a sentence and random characters, upper/lowercase letters.
their GUI allows good organization of what you are talking about with clients, emails, etc. they have folders, groups, icons for organization and some cool features like just double clicking on the entry to copy the password to your clipboard...
and as also mentioned earlier syncing with other devices. But if you use dropbox in conjunction with it, you are synced and can access it from anywhere.
I store the key file in my dropbox folder which enables access to it anywhere. just be careful where you enter that 20 character master password. I use a combination of a sentence and random characters, upper/lowercase letters.
their GUI allows good organization of what you are talking about with clients, emails, etc. they have folders, groups, icons for organization and some cool features like just double clicking on the entry to copy the password to your clipboard...
and as also mentioned earlier syncing with other devices. But if you use dropbox in conjunction with it, you are synced and can access it from anywhere.
