11 minutes ago, bofhlusr said:

You can't easily carry that folder with you when you go on a trip. 🙂

lol nah your  right  bit  hard  to carry  my pc  in  my carry on  bag 🙂

 

Edited November 16, 20241 yr by pete_auau

7 hours ago, eslader said:

If he has 2FA enabled, just having the Steam pw wouldn't be enough unless they're also spoofing his browser which would up the sophistication level quite a bit.

Sophisticated to code, yes. But these scripts are then sold on the dark web to people with a much lower level of tech knowledge. There are even subscription services that ensure you get the latest version of malware since it's a constant game of cat and mouse between the hackers and service providers. Any 17-year-old who downloads a tor browser and has a few hundred dollars in crypto can buy these scripts, modify for their needs, and spam in Discord, Twitter, and anyplace else they can get someone to download and run them. Once they get some good hits, they can use their virtual Steam currency to fuel their CS:GO skin gambling addiction (take a look at Steam community market someday... people can literally get thousands of dollars for a rare pink virtual gun in Counterstrike... what a world we live in!)

The more organized groups purchase up ad space on Google to try and get you to run fake Chrome updates or fake downloads for common software. Google gets paid with stolen money and conveniently takes their time countering the malware ads; they're still getting paid for those clicks after all. An ad blocker is even more of a necessity than a password manager these days for overall web security. But none of this is new... plenty of crazy stories out there from the heyday of the internet. The only difference now is it's packaged up and sold as a service to people who otherwise wouldn't have the means to pull off something that sophisticated.

And today, with AI being able to create whatever code you want... well, let's just say things won't be getting safer on the web anytime soon.

13 hours ago, bofhlusr said:

Interesting.

I keep my passwords offline in a password protected spreadsheet.

I'd have lots of questions if I started relying on another entity for my passwords eg. Will I be able to access my password if I am unable to access the website of the password manager (such as Bitwarden)?  Does the password manager company back up its server offsite and periodically test them, and will I still have access to the backup if the company ceases to exist?

I used to do the pw protected notes file but then mobile phones came along and I started needing to remember passwords when I wasn't on my desktop. To answer your questions:

Yes, Bitwarden and every other PW manager that I'm aware of stores the pws in a secured (well, except apparently LastPass 😉 ) cloud file that then updates the local mirror of any device you're logged into the PW manager on. The worst case scenario would be you updating a pw on your phone and then the service immediately ceasing operations so your other devices don't get the new pw. And that's a low-risk, low-annoyance scenario.

Don't know if they back up the cloud password db (I mean, probably?) but it's not too much of an issue because if the service sees that the cloud file is out of date it can just update it from the most up to date local copy.

5 hours ago, Funky D said:

Sophisticated to code, yes. But these scripts are then sold on the dark web to people with a much lower level of tech knowledge.

 

Good point. Sometimes I forget we're no longer in the days of actually having to know what you're doing. 😄 And yeah, I definitely believe the expensive CS skins. I messed around in Second Life years ago just to see what the fuss was about, and people kept trying to get me to pay real money for in-game versions of things like cocaine. Like, why would I spend money to get an avatar to pretend it's high?  The digital economy is truly bizarre.

 

When someone hacked into my Steam account, the Steam rep asked me for Paypal transaction numbers on purchases. I had them, therefore Steam approved my complaint and restored me. For me the moral is to buy using Paypal and not to leave funds in the wallet. I do believe Steam is safer and more hassle free the MS store. If I need a general PC app of some kind, I avoid buying from the MS store. Too many problems and issues resulted in the few times that I've done that.

5 hours ago, Fielder said:

When someone hacked into my Steam account, the Steam rep asked me for Paypal transaction numbers on purchases. I had them, therefore Steam approved my complaint and restored me. For me the moral is to buy using Paypal and not to leave funds in the wallet. I do believe Steam is safer and more hassle free the MS store. If I need a general PC app of some kind, I avoid buying from the MS store. Too many problems and issues resulted in the few times that I've done that.

Does the MS Store version also require installation of client software at the user end?

The one thing I like about Steam is that I can play the game at any desktop (or laptop) anywhere in the world without having to remember to de-activate the DRM in the home desktop. Can I do the same with the MS Store version of MSFS?

8 hours ago, eslader said:

I used to do the pw protected notes file but then mobile phones came along and I started needing to remember passwords when I wasn't on my desktop.

I solved that portability issue by making back-up copies of my password protected spreadsheet in USB 'thumb' drives.

8 hours ago, eslader said:

Don't know if they back up the cloud password db (I mean, probably?) but it's not too much of an issue because if the service sees that the cloud file is out of date it can just update it from the most up to date local copy.

Another issue with backups is figuring out exactly who has them.  They literally can live forever.  Imagine having backups stored in some unknown location for years and then technology catches up and decrypts them.  

I used to represent and distribute software for a Polish company for the US in the 1990s and was shocked to learn that their website still has me as their rep 30+ years later.  I also found my name in an Italian website a few years back (before Google Translate) but since I didn't understand Italian I didn't bother to do anything about it. I wish I kept a screen cap of that website. Stuff like this makes me hesitate having passwords backed up online.

Edited November 16, 20241 yr by bofhlusr