c/cybersecurity-tips

Two-factor fatigue made me lazy, then a coworker's breach woke me up

Ngl, I used to skip the extra auth prompt on my work accounts because it feels like a drag, but after a guy in my Denver office got phished last month and lost 4 years of client emails, I finally get why that 30 seconds matters. Has anyone else gone back to stricter 2FA after seeing a close call happen to someone they know?

Stopped trusting that password strength meter

Built a password with 14 chars that the meter said was 'strong' last month, cracked it in a day with a basic hash list. Why do so many sites still judge by length alone instead of checking against known breaches? Anyone else run into fake strength scores?

Had my email hacked in a Starbucks in Seattle, now I'm paranoid about public wifi

I was killing time before a flight at that Starbucks near Pike Place, connected to their free wifi to check my bank app. Next morning I got a password reset alert for my email, then invoices for $340 in crypto I never bought. The barista told me they had people sitting in the corner running fake hotspots that look identical. I called my bank and they froze everything, but it took 4 days to untangle my accounts. Now I only use my phone's hotspot for anything with a login, even at home. The worst part is my email had a super strong password, but I never had 2FA on because I thought it was annoying. Has anyone else gotten burned by a spoofed network at a chain coffee shop? How do you spot the fakes before you connect?

TIL my password manager was the weak link all along, not my passwords

I got a random alert from my bank about a login from Chicago at 3am, but I live in Austin and I definitely wasn't awake. After panicking and checking my password manager, I realized the master password I'd been using since 2019 was literally the name of my first dog with a number on the end, and I'd never turned on two-factor for the vault itself. Anyone else ever trusted a tool more than they should and got burned, or am I the only one who overlooked the front door while locking every window?

Hit 100 phishing emails reported in one week, still shocked

I do this little habit where I forward any suspicious email to our IT team instead of just deleting it. Last Friday I checked my sent folder and realized I'd flagged exactly 100 of them in 7 days. That number blew my mind because I thought I was barely seeing any, but it turns out my spam filter was letting a ton of stuff through that looked real. Most were fake invoices or password reset links, but a few were pretty clever with spoofed domain names that almost fooled me twice. It made me wonder how many I missed before I started doing this, and honestly it's kind of scary. Has anyone else tracked their reports like this, and did your IT team actually thank you or just sigh at the volume?

TIL my backup drive was silently corrupting files for 8 months

This is a long body.

Vent: the public library printer exposed my full name and email to everyone in line

I stopped by the downtown branch yesterday to print a boarding pass. The print release screen showed my full name, email, and the file name right there in 20 pt font. The guy behind me was literally reading it while I waited for the page. I asked the librarian about it and she said they've been asking the vendor for a privacy passcode option for 2 years. Why is this even a thing in 2025? Has anyone else run into this at their local library or is mine just behind?

Public wifi at the Denver airport is a hacker playground, bring your own hotspot

I watched three people log into their bank apps on that free network last Tuesday before boarding, nobody even looked at the fake login page I spotted pop up. Why is anyone still trusting open hotspots in 2024, has anyone else seen sketchy redirects at big travel hubs?

Old 2FA method finally gave out on me last Tuesday

I'd been using those SMS codes for years on my email account, figured it was fine enough... then my phone died during a layover in Fargo and I couldn't get into my own inbox for 6 hours. Had to call my wife to read me a reset code from the backup email I set up in 2012. Anyone else stick with an old security method way longer than they should have?

Overheard my neighbor say phishing emails only work on 'dumb people', so I showed him last month's FBI cyber crime report where 3,000 small businesses got hit

The report had a quote from a CEO who lost $180,000 to a spear phishing attack that looked like it came from his own boss, and that made me realize even smart folks can get caught if the email is personal enough. Has anyone else dealt with a close call from a targeted phish that almost got you?

Accidentally broke my own password manager by using a sticky note trick

The fake email that almost cost me my login credentials at a coffee shop

I was sitting at a Starbucks on Broadway last Tuesday, and a guy next to me asked to borrow my phone to show me a photo. Instead, he tried to swipe my password while I was typing my email login into a fake Wi-Fi portal. Has anyone else had strangers pull something like that in public?

Just found out my old router had 12 open ports I never knew about

Ran a simple scan on a whim after that security podcast mentioned default settings and discovered I'd basically left the front door wide open for 4 years has anyone else checked theirs yet?

Company-wide password reset backfired hard at my old job

My last employer made everyone reset their passwords on the same day every 90 days. After the second reset, our IT help desk got flooded with 200+ tickets from people writing passwords on sticky notes. They literally had a stack of yellow Post-its under keyboards all across the office. Has anyone else watched a security policy turn into a bigger vulnerability than the one it was supposed to fix?

Blew $60 on a password manager that I didn't actually need

I was watching a video about data breaches and got all paranoid. Next thing I know I’m signing up for this premium password manager for $60 a year. Then my buddy who works in IT asked why I didn’t just use the free one that’s built into my phone. I never even checked. So now I’m stuck with a year of something I could’ve gotten for zero dollars. Anyone else jump on a paid tool before checking what you already have?

Warning: Got hit with a fake malware popup in downtown Austin last week

I was at a coffee shop off Congress Avenue last Tuesday, using their public WiFi, when a full-screen popup appeared saying my system was infected and I needed to call a number. Looked legit with Microsoft branding but the URL was something like 'security-alert-xyz.com'. I closed the browser instead of calling, but my heart was racing. Has anyone else seen these fake popups getting more aggressive lately?

Burned $40 on a fake USB killer detector off eBay

I bought this little device that claimed to detect malicious USB devices before you plug them in. It was some no-name brand from a seller in China, looked legit in the photos. Plugged it into a random flash drive I found in a parking lot, and it gave me a green light saying it was safe. Then I plugged the drive into an old laptop I didn't care about, and the thing fried the USB port instantly. Lost $40 and almost wrecked my main machine. Anyone else fall for a cheap USB security gadget that was just a plastic shell with a blinking LED inside?

Shoutout to the IT guy at my dentist's office

I was at my dentist's office last week and noticed the receptionist's monitor had a sticky note with the WiFi password taped right to the bezel. The network was named 'DentalSecure' and I watched three patients sit in that exact chair scrolling their phones. Does your office actually follow basic security stuff like separate guest networks or is it just sticker city?

Tried turning off two-factor auth on my Gmail account for a week and nothing bad happened

I know this goes against everything everyone says about security but I got so tired of my phone dying at the worst times when I needed into my email. Last month I turned off 2FA on my personal Gmail just to see what would happen. Been 5 weeks now and zero issues. No weird login attempts, no spam sent from my account, nothing. I still use strong passwords and never log in on public wifi so maybe that's why. But honestly the convenience has been way better than I expected. Has anyone else tried dropping 2FA for a bit and just relied on other habits?

Shoutout to the guy at the coffee shop who warned me about public WiFi

I was grabbing a latte at Starbucks on Main Street last week when a stranger pointed out my laptop was showing a login screen for a fake WiFi network, and that click could've let someone scrape my freelance client files right there.

The coffee shop WiFi that taught me about public networks

Back in 2017 I was at a Starbucks in Portland and logged into their free WiFi to check my bank account. A guy sitting two tables over stood up, walked right over, and told me I was broadcasting my login info plain as day because the network wasn't encrypted. He wasn't trying to steal anything, just warning me, but it scared me straight. Now I never log into anything important on public WiFi without a VPN, and I tell everyone I know to do the same. Has anyone else had a close call like that on a public network?

Hit 500 blocked login attempts on my home server this month

I set up a small home server for file sharing back in February, and I decided to check the SSH logs last night. Turns out I had over 500 failed login attempts just from this month alone. Most of them were bots from random IPs trying common usernames like admin and root. It really drove home why you need to disable password auth and use key-only access. Has anyone else gotten numbers like that from a setup that isn't even public facing?

PSA: My brother's old router got busted because he never checked the default login

I helped my brother set up his home network last month in Austin and noticed he was still using the admin password that came printed on the sticker. When I ran a quick scan with a free tool, it showed his router had been accessed by unknown IPs 4 times in the last week alone. Has anyone else dealt with a family member who just ignores basic login security like this?

Hot take: That $200 password manager subscription was a complete waste

I bit the bullet last year and paid for Dashlane's premium plan after all the hype in this sub. 200 bucks for a year seemed steep but I thought my data was worth it. Then I spent like 3 hours migrating from my old setup and realized the free version did everything I actually needed. The extra features like dark web scans? Just told me stuff I already knew from checking haveibeenpwned for free. And the VPN? Slower than mud. I'm back to using Bitwarden's free tier now and honestly my life is the same. Has anyone else overpaid for a tool that ended up being overkill?

Just saw my password habits from 2 years ago vs now and it's wild

I stumbled on an old password list from early 2022 and every single one was like 'dog123' or 'summer2020' with zero variety. Then I looked at my current setup which is all random 16 character strings stored in a manager. The difference is literally night and day after I got phished on a fake Amazon login page last April. Anyone else have that moment where you look back at old passwords and cringe?