c/cybersecurity-tips

16

phoenix_singh25•1d ago

Noticed a big shift in phishing emails over the last 3 months

I used to spot phishing emails pretty easily with bad grammar and weird links. But lately the fake ones I'm getting look exactly like real messages from my bank and even my boss. A coworker almost clicked one last week because it matched the company logo and signature style. What changed are these scammers using AI tools to copy real layouts way too close. Has anyone else seen this jump in quality with the fakes they get?

22

johnson.river•1d ago

PSA: That "I use the same password for everything but with a number at the end" trick is not actually secure.

I keep seeing people in this sub claim that adding "1" or "2024" to their base password makes it strong enough for banking, but after watching a coworker's account get drained last month from a simple credential stuffing attack, doesn't that logic fall apart when the hackers know the pattern and just run a script to try all the variations?

31

samrodriguez•6d ago

Switched from LastPass to Bitwarden after 4 years, here's how it went

I finally gave up on LastPass after their last breach last year. Moved everything over to Bitwarden in about an hour. The import process was smooth and I actually like the interface better. Has anyone else made this switch and noticed any quirks I should watch out for?

9

mark_green•8d ago

Saw someone reuse a password from 2018 on their bank account today

I help people reset their accounts at my IT job, and I can't believe how many folks still use passwords they made like 7 years ago. Have you ever checked how many times your old passwords show up in breach lists?

8

max_cooper21•8d ago

Just realized password managers aren't always the answer

I work for a small contracting company in Pittsburgh. Last month our office got hit with a phishing email that looked like it came from our password manager service. Three people clicked it because they trusted the login page. Two weeks later we found out someone had accessed our project files and billing info. Everyone talks about password managers like they fix everything, but they don't protect you from people falling for fake login pages. I think we put too much trust in these tools and forget about basic training. Has anyone else seen their team get tricked this way?

24

anthonynelson•11d ago

Caught a phishing email at 2am that almost got me

Working night shift at the hospital last Tuesday, I got a text from 'HR' saying my direct deposit changed. Looked legit with the logo and everything, even had a link to a login page. But I noticed the URL was hxxps://company-payroll.xyz instead of the real .org domain we use. I reported it to IT and turns out 12 other people on my shift clicked it before I caught it. Now I double check every single link before I tap it, even at 3am when I'm running on coffee. Anyone else get hit with these fake HR texts lately?

26

hannahcraig•11d ago

Finally got my grandma to switch to a password manager after 6 months of begging

She sent me a screenshot last week of her new password vault with 47 logins and said "this is way easier than my notebook" which made me laugh because I learned you really just gotta find the right moment to show them the practical benefit instead of pushing it.

4

corah75•12d ago

Had a fake 'security update' popup freeze my laptop in a coffee shop in Seattle

I thought I knew better than to fall for those things, but this one looked exactly like my antivirus software and locked me out completely until I paid $150. Has anyone else dealt with a fake update that looked way too real?

10

gracethomas•12d ago

Got burned by a fake phishing test at work last Tuesday

I used to just click any link in an email that looked official, like from IT or HR, without a second thought. Then last week our security team sent out a fake 'password reset' email that I fell for, and I had to sit through a 30 minute lecture about it. Anyone else get caught by one of those tests and feel like an idiot after?

1

olivia670•15d ago

The 'use a password manager' advice vs. 'just memorize strong ones' debate...

My coworker Steve insisted password managers are a single point of failure, so I spent 3 months memorizing 20 random passwords. Then I forgot my main email password and locked myself out for two days. Has anyone else found a middle ground that actually works?

20

blair_chen81•15d ago

Vent: Used to click every email link like it was nothing, now I scan everything with VirusTotal first

Back in 2020 I got hit with a clipboard hijacker from a fake shipping notification. Lost access to my crypto wallet for 3 days before I figured it out. Now I never click a single link in an email unless I paste it into VirusTotal first. Even then I hover over the URL to check for misspellings like amaz0n or paypa1. That one attack cost me about $200 in transaction fees to recover everything. Has anyone else had a similar wake up call from a phishing attempt?

11

angela_morgan•15d ago

The day I switched from a single password to a password manager was a game changer

I used to reuse the same password for everything until my email got hacked last spring and someone tried to order $400 worth of stuff on my Amazon account. Has anyone else had a wake-up call like that that made them finally get serious about passwords?

2

adam_baker•16d ago

Finally found a way to stop phishing emails from slipping past my filter

I kept getting these fake 'package delivery failed' emails that looked super real. Tried a bunch of stuff but nothing worked until I set up SPF and DKIM records with my domain host Namecheap last month. It dropped the junk by like 80% and now I can actually trust my inbox again. Has anyone else had luck customizing their DMARC policy to block the rest?

6

angela_morgan•17d ago

Can we talk about that fake Microsoft support call that ate 4 hours of my Monday

I got a popup claiming my Windows license expired (which it didn't) and called the number on the screen like an idiot. After 2 hours on hold and another 2 hours letting them remote into my machine, I finally realized it was a scam when they asked for my credit card. That was 4 hours I'll never get back, and the worst part is they left a backdoor that took me another hour to clean out with Malwarebytes. Has anyone else dealt with those fake error screen popups that look way too real?

17

willowr96•18d ago

Forgot my laptop at a coffee shop in Portland for 15 minutes

I was at Heart Roasters on 12th last week and stepped outside to take a call. Came back in 15 minutes and my laptop was still sitting there on the table. But the guy next to me said someone picked it up, looked at it, and put it back down. That freaked me out because I don't even have a password on the lock screen. I set up a PIN and turned on Find My Device as soon as I got home. Does anyone here use a Kensington lock for their laptop when they work in public?

24

harperp24•18d ago

Pro tip: A coffee shop WiFi scare taught me a lesson about public networks

I was finishing up some banking at a coffee shop downtown last Saturday when my laptop flashed a warning about an unsecured connection. Turns out the shop's free WiFi had a fake login page that looked real, but I caught it before entering my password. Has anyone else had a close call with a public hotspot that made you change your habits?

4

the_brian•18d ago

The 2023 data breach report from Verizon blew my mind

I was reading through the Verizon Data Breach Investigations Report last week, and 74% of breaches involved a human element like clicking a link or sharing a password. That number is so much higher than I thought, and it makes me realize we focus too much on fancy software instead of basic training. Has anyone else seen stats like that and felt like we're fighting losing battle?

17

nathankim•18d ago

Actually glad that IT guy at Micro Center talked me out of that biometric lock

Back in May I went to the Micro Center in Cambridge to buy one of those fancy fingerprint padlocks for my server closet. Guy behind the counter said he'd seen too many fail after firmware updates bricked them. Told me to stick with a simple combo lock with a backup key. Three months later my neighbor's smart lock got hacked through some Bluetooth vulnerability. Makes me wonder why everyone pushed biometrics so hard without asking what happens when the power dies.

18

taylor_patel•25d ago

Overheard my neighbor bragging about using 'password123' for everything

I was out getting my mail yesterday and my neighbor was on the phone saying he uses the same password for his email, bank, and Netflix. He said it was 'password123' with a capital P and he's never had a problem. I wanted to yell at him that his credit card info is basically free real estate for hackers. Has anyone here actually convinced a friend or family member to change their passwords after a talk like that?

21

hannahcraig•26d ago

Just realized my password manager was never actually syncing to the cloud

I spent 6 months manually updating passwords on my phone and laptop thinking the app was doing it automatically. Turned out there was a tiny toggle in settings I never clicked. Anyone else find a default setting that broke their workflow without them knowing?

2

harperp24•27d ago

Compared password managers for 2 weeks

I tried Bitwarden and LastPass side by side for 14 days. Bitwarden won easy. It's open source so I can see what's happening. LastPass had those breaches and I just didn't trust it anymore. Also Bitwarden is free for basic stuff while LastPass wanted $3 a month. The interface on Bitwarden is simpler too. Has anyone else moved away from LastPass after their leaks?

13

keith274•1mo ago

That free password manager my buddy swore by actually caught a phishing email

I figured anyone giving away security software was probably selling my data on the side, but after I clicked a fake "package delivery" link and Bitwarden flat out blocked it on my phone, I had to eat my words. Anyone else get humbled by a free tool doing a better job than the paid stuff?

30

kai_chen2•1mo ago

I finally read the fine print on my password manager's privacy policy

Last night I was bored and actually read through Bitwarden's privacy policy and found out they collect metadata on your IP and device type even with encryption. That got me wondering what other services are quietly grabbing data we don't expect. Anyone else ever dig into their security tool's policies and find something sketchy?

21

amyh12•1mo ago

That conversation with my dad about his phishing email changed my mind on something

He clicked a link that looked like his bank, and when I asked why, he said the email was 'too official' to ignore. It hit me that most people aren't being careless, they just don't know how to spot the really good fakes. Has anyone else had a family member nearly fall for something that looked totally legit?

6

josephbailey•1mo ago

Saw a guy at the local library log into his bank on public WiFi and it changed my mind about VPNs

I was at the public library over on Oak Street last Tuesday waiting for my turn at the printer when this dude next to me just pulls up his banking app on the free WiFi. I always figured VPNs were overkill for regular folks like me, but watching that made me realize how easy it would be for someone to snag that info. Now I actually use a VPN on public networks, even just for checking email. Has anyone else had a moment where they saw something dumb and it made them change their own habits?