Replying to
@markwyner@mas.to : in addition,
— At least on Android and iOS/iPadOS devices, configure your OS and password manager to use AutoFill. This helps prevent phishing via fake websites (often using a slightly different domain name, while the login page looks identical to the one on the real website). See the screenshot below (additional details in the Alt text).
— Important: when using AutoFill, if no credentials pop up from your password manager, don't start looking in the database itself like Troy Hunt did by mistake (https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/)
— Make a backup of your password manager database after each change. Preferable have multiple backups, at least one offline.
— Configure your browser to always warn for http (instead of https) connections.
— When using unique strong passwords, don't use weak 2FA/MFA. The advantage is negligeable while the risk of account lockout (caused by loss of the second factor) is huge. In particular TOTP sucks; most "Authenticator" apps are insecure privacy-risky stupid password managers without phishing resistance.
More info in https://todon.nl/@ErikvanStraten/115611078608008423
#AutoFill #PasswordManager #StrongPasswords #2FA #MFA #TOTP #WeakMFA #Weak2FA
