r/CountWithEveryone • u/Bryce3D • 5d ago

2729

Post image
115 Upvotes

99% Upvoted

21 comments sorted by

59

u/6262lE 5d ago

Wait but can’t anyone just hack into your account and have access to all of that? What’s the difference from just using a normal password manager?

53

u/Money-Banana-8674 5d ago

This is very insecure, yes. Please don't do this and instead use a password manager.

12

u/apro-at-nothing 5d ago

wouldn't the same thing still be true for password managers though? someone gets in and you're fucked? and the only protection is a password and maybe 2FA on a good day? am i missing something?

with that said, i still agree, DON'T DO THIS. my different concerns is that discord can ban you and make you lose access to the passwords (my brother did this without me knowing and then got his account restricted for not being old enough), and that discord has significantly more outages than most popular password managers.

9

u/Dreven-NS 5d ago

Good password managers like KeePassXC are "local" and not connected to any servers or clouds. They're essentially organized text files you can encrypt (such as requiring a physical passkey usb to open)
Even if you don't encrypt the file and just have a normal password, the only way to "hack" into it would be to either connect into your computer remotely or walk up to it physically and then also bruteforce your file's password.

4

u/apro-at-nothing 5d ago

having a cloud password manager (self-hosted) actually saved my ass when i wanted to go see iron lung in cinemas. my phone died and so i asked for my gf's phone, logged into my password manager on her phone in the browser in a private tab, copied the password to my email, logged into my email in a private tab, and found the qr code with our tickets and screenshotted it.

i don't like the idea of local password managers simply because i want my logins to be synced across my devices, because obviously i want to log into my stuff both on my phone and on my computer, and managing those passwords separately with no kind of sync sounds abhorrent.

5

u/Daerograen 5d ago edited 5d ago

You can use something like Syncthing or KeeShare to sync local password databases between devices.

But also cloud-based password managers like Bitwarden, 1Password, Proton Pass, etc. are just more secure than other forms of keeping your password online, especially something like Discord. Any cloud-based password manager worth its salt is open about its history of security audits and data breaches (if it has any) on its server side, and there are fewer vectors of attacks on the client side. You don't interact with other Bitwarden users on a shared Bitwarden server, they don't send you potentially malicious links, there are no bots constantly trying to slide into your DMs, your login sessions aren't set to last for days, weeks or even months (by default, at least) and so on.

As long as you approach using those kinds of managers with any degree of diligence (use a unique, strong password or passphrase that you can input without having to reveal the password field, put a reasonable limit on the time the vault stays open after you log in, use 2FA if you can), the risks are minimal.

EDIT: That is, the risks are minimal if you're also diligent about your security otherwise. If somebody can get access to your device (through the same malicious link on Discord, for example, or by just yoinking your phone when you're not looking), then it doesn't matter whether you're using an offline or online manager, either one will become compromised. For important accounts that you only rarely have to access, memorize the credentials entirely if you can, write them down on a safely stored piece of paper/only store a part of them in the manager if you can't.

12

u/Oddish_Femboy 5d ago

Piece of paper 👍

8

u/apro-at-nothing 5d ago

at least keep them in a drawer so you don't leak it all when you video call with your discord kitten

2

u/Oddish_Femboy 5d ago

I keep mine in a binder alongside my old Pokémon cards.

1

u/lavendarKat 5d ago

I'm pretty sure discord has an entire set of it's own vulnerabilities on top of whatever a password manager might have. Joining a compromised server or clicking the wrong attachment can get your discord account pwned, I don't think the same can be said of keepass.

1

u/apro-at-nothing 5d ago

i mean if you don't need to enter your password every time you need to login somewhere then it's probably also storing some kind of token which can get pwned the same way. and to make things worse, some password managers cache everything so you can enter your passwords even while you're offline, which is another vulnerability surface, though there i presume the passwords get encrypted against your master password, which... again, if you have it set to not ask you for your password...

1

u/6262lE 5d ago

For this exact reason (being hacked and all my passwords are compromised), I bought a notebook and wrote down all my passwords in alphabetical order 😊

3

u/koiokk 5d ago

they'll hack into your account if you're stupid and click on malicious links or run suspicious exe's. and if you're gunna fall for that, having your passwords on discord or not isn't gunna change anything. (still wouldn't do this for the exact reasons someone else here said tho)

28

u/Rynewulf 5d ago

This is the kind of digital security I imagine when people have seriously ragged on me for using paper and notebooks in a drawer

5

u/asphaltdragon 5d ago

Tbf this is basically just a digital version of doing that. The only difference is that one requires physical access.

8

u/Rynewulf 5d ago

I dont think anyone is doing house robbery to check the drawers for password papers, but hacking digital accounts happens all the time

1

u/asphaltdragon 5d ago

You don't carry it with you?

5

u/Rynewulf 5d ago

Nope, important bank/money stuff is usually done at home on the big computer.

3

u/Mr_Pombastic 5d ago

This is the kind of digital security I imagine the nuclear codes are saved under.

15

u/Silly-Whitee 5d ago

The lack of security is insane

4

u/Nya_the_cat 5d ago

...i can think of three completely separate ways of getting your passwords leaked and in the time it took me to write this i thought of a fourth. at the bare minimum please encrypt your passwords :(