Hacking attempts - long passwords, 2FA & passkeys

[Chet]

I have had 5x failed logon attempts over the past 2 years. The 15 minute lockout after five tries is great as is notification of them. I have had 2FA enabled for a very long time, but it is now past time to go to passkeys. Syncing it to other devices is coming but it would be great if Fastmail could be an early adopter of syncing passkeys to other deices as I sign on from many devices.

[trikotret]

Originally Posted by Chet

I have had 5x failed logon attempts over the past 2 years. The 15 minute lockout after five tries is great as is notification of them. I have had 2FA enabled for a very long time, but it is now past time to go to passkeys. Syncing it to other devices is coming but it would be great if Fastmail could be an early adopter of syncing passkeys to other deices as I sign on from many devices.

I use a FM username that I never give out to login. Non one will ever be able to try logging in unless its an inside job.

[TenFour]

I use a FM username that I never give out to login. Non one will ever be able to try logging in unless its an inside job.

The biggest threat to all of us is a phishing attack that tricks you into entering your username and password into a fake login page. 2FA should prevent that attack from being successful, but there are also ways that hackers can get around that too.

[SideshowBob]

Originally Posted by TenFour

The biggest threat to all of us is a phishing attack that tricks you into entering your username and password into a fake login page. 2FA should prevent that attack from being successful, but there are also ways that hackers can get around that too.

2FA doesn't prevent that because the second factor typically goes through the fake website too. This is the reason that passkeys are being pushed at the moment.

[DumbGuy]

Originally Posted by trikotret

I use a FM username that I never give out to login. Non one will ever be able to try logging in unless its an inside job.

I do this as well. A very underrated security feature of FM that more people should learn about.

[chrisjj]

Originally Posted by trikotret

I use a FM username that I never give out to login. Non one will ever be able to try logging in unless its an inside job.

... or a malware keylogger.

[n5bb]

I do not understand why a dictionary type random search for your login name would not be just as successful as such a search for your password. All someone has to do is to try sending emails to random Fastmail email addresses and when one does not bounce it must be an existing login address. To my knowledge, you can’t turn off accepting emails sent to your login address. The only way to prevent this is to use a very long and unlikely to guess login address. I have some Fastmail accounts with short usernames, but I have very long and hard to guess unique passwords on those accounts.

Bill

[DumbGuy]

Originally Posted by n5bb

The only way to prevent this is to use a very long and unlikely to guess login address.

Yes, that's my situation/strategy. And I have a couple of FM email aliases I do use for sending email, and a few domain names I own and have connected to FM as well, and have many email addresses for those domains.


I get very little spam in general, so I'm able to quick-check the ones I do get and note the destination email addresses being used. In my 15+ years with FM, I've never received spam to my FM-login email address (that I've never used for actual email) because it's sorta long and sorta unique. Fingers-crossed!

[n5bb]

A search indicates that except for Fastmail staff and support messages, I have only sent or received one pair of messages using my main login address. That was an accidental message sent to a friend, who replied to the From address. There could have been random spam messages, but I don’t remember them and in any case didn’t save any such emails.

Bill

[placebo]

Originally Posted by Chet

Syncing it to other devices is coming but it would be great if Fastmail could be an early adopter of syncing passkeys to other deices as I sign on from many devices.

Could you elaborate on what you mean by this? I don't see why Fastmail would have anything to do with the syncing of passkeys among your devices.

[SideshowBob]

Bear in mind that passwords need to be long to be secure against an offline attack, but in that case the length of the username is irrelevant. Online attacks against passwords are impractical for all but the simplest cases. No one is getting into your account that way unless there has been reuse from another site.

The chief thing with usernames is to pick one that hasn't been reused, it doesn't have to be particularly long or complex - my username is a simple dictionary word and I've never seen any spam on it.

[TenFour]

Back to the OP's original question.

Syncing it to other devices is coming but it would be great if Fastmail could be an early adopter of syncing passkeys to other deices as I sign on from many devices.

Doesn't the "syncing to other devices" happen in your password manager not within FM or other applications? And, isn't that being done already with major password managers?
Google says this about passkeys:

Passkeys are also created and stored on your devices and are not sent to websites or apps. If you create a passkey on one device the Google Password Manager can make it available on your other devices that are signed into the same system account.

https://security.googleblog.com/2023...than-ever.html