603
15M Trello accounts have been leaked (lemy.lol)
submitted 2 years ago* (last edited 2 years ago) by to c/technology@lemmy.world
101 comments fedilink hide all child comments
 

I just got the email from haveibeenpwned. F Trello.

you are viewing a single comment's thread
view the rest of the comments
[–] 26 points 2 years ago (12 children)

Yes but this wasn't a data breach. This was a data stuffing incident, meaning they took someone else's data dump and tried their email and credentials here.

  • never use the same username and password in two or more places
  • always use MFA, a hard token if you can like a yubikey
  • permalink
  • fedilink
  • source
  • parent
  • hideshow 12 child comments
    •
  • [–] 1 point 2 years ago (2 children)

    Physical token over TOTP authenticator?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 years ago

    all the root secrets are available in plain text the generator app at some point, they have to be. moving that to a single purpose device greatly reduces the risk of vulnerabilities in your phone leading to exfiltration via internet connection

  • permalink
  • fedilink
  • source
  • parent
  • [+] -8 points 2 years ago (5 children)

    Do you own a Yubikey?

    Have you ever succeeded in getting it to work with anything??

    It didn't work with gmail, or any other online account I had.

    An absolute waste of $$.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 8 points 2 years ago

    mine works for my personal google account, work one is sso and doesn't have it enabled. otherwise gh, aws, auh0 support it, I'm forgetting some others I use. beyond that you can generate 2fa codes too

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 2 years ago

    I use yubikey everywhere it's available for me. Initially, the first few websites in the early years were challenging. I think a lot of devs were still trying to figure out the workflow.

    But today, it's usually as simple, or simpler, than TOTP.

    So it might be worth trying again. I'd use a YubiKey 4 or higher if you can. If you have an older one, you may want to upgrade to take advantage of the newer technology like NFC and Bluetooth if you're into that.

    I just wish YubiKey could store more than like 30 TOTP tokens.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 2 years ago

    Sounds like a skill issue.

    Have had yubikey for a few years. It was a pain to set it up initially, but it took me less than an hour if I remember correctly. Since then the only issue I have is that sometimes I accidentally bump into it and it pastes an OTK to a random place.

  • permalink
  • fedilink
  • source
  • parent