Hasty Treat - Get Gud at Passwords & Password Management

six digit code, which, like, I remember being, like, 7 years old, and my dad had this little thing on his key chain, like, a password reset token or a 2 factor authenticator token, and it just text it to them, and then they have access to your entire account. My sister had it. They drained her entire PayPal account,

a good way to get them to wake up to some of this is to just have them enter their email and say, have I been pwned? So then this website say, enter your email here Yeah. And see if you've been hacked because that can be a real eye opener for a lot of people to see that and then just see, holy cow,

sorta like one time use passwords. So if you don't have your phone on you or you can't get access to it or you totally lost it, It's not someone's not just trying to sit there and guess. It's that when it does get out, it's only an amount of time before your McDonald's and your Uber and your PayPal. All of those things are like people will test if these passwords work, and then all of a sudden, you're you're out of luck. Like, it's it's such a huge pain to have to try to revert all of that. So never reuse a password. And this isn't just like some Node sitting in his basement trying 1 password at a time. These are either complicated,

your phone provider out of her PayPal.

is a weak point, I recommend not using Yeah. Bitly some app that I had used years ago. I don't know which one, but, obviously, it was breached at some point. And then what happened is someone went and bought $8 worth of McDonald's,

And another step you can take JS, at least with my own provider, which is Fido in Canada, you can lock transfer, meaning that I had to call them. I said, lock transfer. So if I ever

Head on over to syntax.fm

your backup codes are what is gonna save you,

what are the AT and T and Virgin. Those are in the states. I'll use those. So I'm moving from AT and T to Virgin, and you have to port my number. So they sign up and they pretend to be you, and then they just port your number. And now all of a sudden, some some malicious actor has a new phone with your phone number,

this podcast and string together, I would like to change my cell phone provider or just take them as I said. Fine, smoking meats. Smoking meats.

some text messages will do. The reason why they don't do it is because there's this thing called SIM jacking,

Awesome. Alright. Thanks for tuning in. We'll catch you on Wednesday.

some other service.

very of which have been this, like, 6 digit code that is a 2FA code that sort of it changes. However, was it every 30 sec every Yeah. Every 3 seconds? Or 30 seconds, you get a new And,

I think it would be okay because of the reasons we just talked about. Yeah. And you just put them out, put them somewhere safe. And, if something ever happens,

Oh, the decor.

Authenticator Now I'm currently looking at the discover tag, which has a little new sign because it's letting you know that, hey. This is a new and it's looking for

someone could probably take words from

the whole idea behind 2 factor authentication is it's something you know, your password, and something you have. It's Yep. Your, like, your phone. Right? And you have a code on there. And if you put them in the same place, isn't that kinda defeating the purpose? Like, if somebody gets into your your one password, then they'll have both things that they need to get into your account. So for the longest time, I was like, that's dumb. That's the silliest thing ever. And then I finally, like, looked into it. I was like, why why are people doing this? And then I realized that you can't set up,

Yeah. So we should say, like, the whole idea behind two factor authentication is that even if someone does get your password

She had to oh, like, PayPal was trying to tell her tough luck. They took, like, 3 or $4,000 500 pixels,

I recommend

from thing, which is amazing. So I had resisted this forever. I was wrong, and then you only can do that. Yeah. A lot of places will only allow you to do it, which I don't like. I think the reason they do that is because of the support overhead.

another app that has 1 password on it that is logged in or from somebody in your family who can also get that secure sign in code. So very popular in, PHP world. Specifically, WordPress uses it.

But let me tell you, please

one and a half week waiting period. They they really make it. Yeah. No. It's intentional because Yeah. They don't want somebody all the time.

using 1 password for this because then I moved over to Google Authenticator because

you get hacked, before your PayPal gets drained because it's a nightmare, then they they they still can't log in, which is great.

What else is when you set up two factor authentication, you almost always get backup codes, and it's anywhere from 5 to 20 different codes, which Yarn So, likely, your phone or and or your computer has face ID, touch ID, some sort of sensor,

1 password itself is two factor. Meaning you need your master password and you need a code to set it up on a device. So meaning that JS even if somebody got my 1 password password, they wouldn't be able to log in

then you have to go and reach it for those backup codes. And I've I've had to use mine once or twice before,

I should have done a better job of remembering these backup codes. Maybe I'm gonna start turning it off on some services

I lost all of my comments. So the process will email you your password or, like, I know Bluehost does this. They ask for the last 4 characters of your password, This is where Chris Coyer got his passport So if 1 password gets hacked, the person just gets encrypted I love to eat. And then, uppercase pizza. Just decide on that for how you're going to spell it. And then what you do is to in order to make that password unique, because you can't just use, I love to eat pizza on every website, you have to make an algorithm

trying to get this stuff back. So take precautions now. Wash your hands. Yeah. Yes. Right. I think

and then moving everything over to 1 password. I think you've convinced me. It's, like, kinda scary, and and that's the reason why a lot of people don't do it because they say, like, well, I don't wanna I don't wanna be locked out out of my account.

like, all you only have to remember a master password because when you export it, it gives you, like, a pnpm encryption password. And then when you import, you have to type in that encryption password. So as long as you have that encryption password, you're good with Authenticator plus. But, yeah,

for various reasons.

and you can print those out. I don't know if it's a good idea to put the backup codes in your one password.

I don't know if I've taken proper precautions for if my things go bye bye, but I,

when you log in, they will then still ask you for this Node. And, Yeah. Oh, man. Like, Caitlin did that too. She lost it, and then she just stopped using 1 password altogether. Yeah. Like

Oh, no.

And Oh, cool. Yeah. The reason why that's great is because if you lose access to your authenticator, with an ampersand or a at sign as an a. So that's not really a thing. I I always reach for a generator that generates a nonsense password myself.

because Some places

which somebody and this happened to my sister a couple months ago. Somebody will go I lost

Yeah. If it offers it. And some places will even give you a discount. Mailchimp gives you a discount for using it. So, tool that really just makes everything so so easy.

it is a giant pain in the butt

You are authenticated.

from, built in password remember, Smoking meats. Barbecue sauce.

type your password because of biometrics.

because of these things. You very rarely ever have to

people have access to these things of mine. So,

and that sign in code is generated from,

You know, it's still it it since 2014, it has sat with me. So,

Wes, password for a full archive of all of our shows, and don't forget to subscribe in your podcast player or drop a review if you like this show.

and then I have to I think it takes, like, a week to unlock it or something like that. What did you what was your saying? Was it, hey, everyone? Oh.

my what's it called? Has,

I dropped my phone in the lake, and it started acting up. So I brought it ESLint Apple, and they replaced it for me. And I was just driving Node.

And, if you're interested in a little bit of extra listening on this type of thing, please, I implore you to listen to this episode of the shop talk show. I don't know if you've listened to this one, Wes, but it's from, 2014.

Yeah. Hey, everybody. Yeah. Let me let me allow me just to say what I said right then. No. They they just asked me they just asked me a bunch of questions about, like, what I had for lunch, and I think that it,

Plus I can tell you exactly why that is coming up because that's a very standard bug. But this allows me to see every time this bug or this error is happening, when it's happening on my server, if it's on my API, my front end, wherever it is, I can track this thing. I can take a look at it. I can fix it, find it, Yarn it as resolved,

you can't log in to 1 password. You can't set it up on a phone. You can't log in to it with an app without having an additional Yeah. I I don't think so unless you have backed up your initial QR code.

So if that's the case, then you have to turn off 2 factor. This is what I'm doing with everything.

to get it get back into my account.

has done a pretty good job. Well, I guess the fact that I can export Yarn and I both used

is that Mhmm. They have a I I iWatch or whatever the Apple Watch is called. They have the Apple Watch app so that I can get the codes on my on my watch, and I can just look on my my wrist, hit it, and then type it in, which is way better than looking at your phone or,

you don't have to whip out your phone or look at your watch every single time that you wanna code. You can just open 1 password,

Totally. Cool.

locally has proper hygiene from bugs, and we don't want bugs in our application.

turn on 2 factor authentication for every service that offers it. Yeah. Definitely.

Wow. Jeez. That's a nightmare overall, and I hear these these stories all the time. So because turn those on because And and then every time that you sign ESLint a website or every time you sign up for a website, your master password should be strong, and typing it every single time you wanna open that sucker up sucks. So, So just write it down, put it somewhere super safe so you won't accidentally a different way to get back in, and it it probably took me 2 weeks to get back into to every single one. It takes time. Authy Authy is like a like a like an actual

and it's the best workflow I've I've found so far for this type of thing. I wonder if I can easily migrate. I don't know. It seems,

to authenticate you into the site, as in you need more than just a password to get in. You need a password plus something that is a little bit more secure. Right? And there's a whole bunch of different ways to do 2FA,

typing your master password And for the longest time, I'm like, that doesn't make sense So Fantastic. Thanks. Talk about let's talk about,

of getting and then they can just request,

Peace.

to Other people say JS, like, you can just back up the QR code. So the QR code that you scan to set up 2 factor authentication,

Next up is, they on other popular websites. So Yep. Case in point, this happened to me. I was getting a little sloppy for my McDonald's password,

just jacking it from you or like that. So I actually recently probably in the last month, I switched over from Google Authenticator

over to,

not doing this,

go ahead and listen to that because it is very, very fascinating.

on a device unless they had that secondary code to to log in. So Anyways, just call your provider and and ask them, like, what can I do to stop getting SIM jacked? Because

back into your account when you have don't have the codes is very hard because you have to, like, submit your driver's license or some some sort of proof. Every every single one has a,

forged. Yes. Chris Coyer got hacked, and then he interviewed the hacker on the show. It is

And if they don't have physical access to your phone,

Yeah. Yeah. That's cool. Yeah. I I I like Authenticator plus maybe keep some of these things in in separate little islands, but I totally see where you're coming from. That sounds like a really nice little workflow. And, especially, again, if you're trying to make security easy, that is the goal. Right? Then keeping everything within 1 password is definitely the the easiest way to go here.

Well, that happens when someone forgets their password, then you have to, like, assign someone to spend 20 minutes working with this person to get back into their account. Like, I have it with Slack. Like, my Slack room, like, couple times a week, people are like, I lost my 2 factor authenticator for Slack. Can you reset it? And, like, I, as a Slack admin, need to go in and turn it off for their account. And I'm like, oh, this is such a pain. Right? Like, imagine I think there's just some services that wouldn't do it. And then I actually, yeah. Whatever. Yeah. Anyway, we should say, like, when a website gets hacked,

to VPN ESLint his work. And I'm just like, oh, man. All these years later, I finally understand what that's for. Yeah. So the two f a, is just such a really interesting thing. It makes you feel like a secret agent because you're getting this special code. So what happens is you'll go to log in to a service, and it's gonna say, okay.

like, it has never been better for just regular people to use a password manager because of, these providers like, they don't just have a database full of all of your passwords, and if that gets hacked, then you're screwed.

know that this is a problem, and they are starting to implement stuff, at least in Canada there.

for years, and we talked to him to see about how awful the user experience is on LastPass. I would recommend to nobody, no matter how much money they spend on sponsoring YouTubers, don't use LastPass. It's awful. And I'm I'm not saying that because, like, I I don't like the company. I'm saying that because I've tried to get family members on LastPass,

Like, you Node.

turn everything else off, key chain, all of this stuff, turn it all off except for whatever password manager you're using, or sorry. You could take the 3rd letter of

Because he's like, Node. That's I shared all these passwords with. She'll be like, what's the Amazon password? I'm like, I'm not reading this this line of of No. You know, generated text out to you. So where's your Node password? management, how to lock those passwords up because you don't wanna make sure anything

nobody in all of land can help you because all of your passwords on their server are encrypted, and even 1 password can't unencrypt them unless they have some sort of, like,

Chrome or Firefox confidential needs to get better password hygiene. Please figure this out now before

because, new bugs that have popped up. For instance, I'm seeing this interesting bug popping up here, and it looks like it's coming in on our API.

really wants you to use their their solution. Chrome's like, can you please MyFitnessPal. MyFitnessPal. Patreon.

It also tells you which of your passwords are reused on multiple sites.

and life will be so much better. I guarantee it. Yeah. Totally. And and, you know, okay, I should offer up a a tip here. Let me pop up in Chrome because it is Chrome, like, really, episode of Syntax, we're gonna be talking about password

They don't have an like, it doesn't work on Firefox, and it doesn't I don't think they have an app as far as I could see. So, like, it's just, like, not there. And, also, they don't have Node, like, password manager notes for me, things that I want like,

it'll try to add that password to your list of passwords, and then you have a master password that code has a number in it, which will allow you to generate these things. And if that over to using 1 password for 2 factor authentication.

So let me pop up in my extension here real quick for 1Password.

passwords. It's they don't get access. And that's the reason why if you forget your master password, yeah. Yeah.

It's in like, it's on us as developers to make this stuff as as easy as possible because I know. Like like, what do you do with your master password? Well, like, first of all, you can recover it if you have a family member on the same account. Like, you can assign sign in code. So, because they basically scrape data and buy databases from people. Like, anytime I subscribe for a magazine, Yes.

that you can use to to sign in to your whatever. So I personally use 1 password. I was on LastPass the text message codes where possible.

Bos

Other tips here. So one huge tip I have for people JS turn off if you can turn on fingerprint or face ID to get access to your passwords, that's just another,

So I don't know, but people seem to really like it. Yeah. There's Dashlane seems to be pretty popular, and Bitwarden is a open source version of it. So if you want to host the the password database yourself,

The watchtower In addition, here's another little hot tip. If you are using 1 password, take advantage of their watch tower feature. This one might go sort of, you know, above the radar if you're not looking for it or below the radar. I don't know. I'm not a radar technician. Under the radar. Yeah. Under the radar.

what they do is they encrypt it based on your your master password.

lose that because Yeah. It's it's not the end of the world. You can go through the process of of resetting every single password that you have.

use our password manager?

which is what happens is yeah. It's it's hard to do because it, like, gets in the way. It, like, drops down in front of the Node password.

things, like passport numbers and expiry dates, all that stuff needs to be saved. Credit card numbers.

Like, it JS not the end of the world, but it's it's just a pain. It's a pain. Yeah. Totally.

But, also, I see a lot of people relying on that. And then then then that's not like it doesn't work on their phone, so, like, their passwords aren't remembered from that. And then, like, when they change your password, it updates in Node of them, but not both of them. And then it's out of sync, and that's where a lot of this frustration with these password managers. If you have 1 single source of truth on all of your devices, turn on biometrics.

Yeah. I was gonna use, like, Google password because they have, like, their own thing. They have their own generator. Yeah.

once we move to 1 password, it definitely it's just so much nicer. The interface, everything is just way easier to use. But there there are certainly other good versions in other good applications as well. I just don't have the experience with some of these, like Dashlane. Haven't used it before.

within data breaches.

So it can take a look, and it can say, hey, dude. You're using the same password various things. So,

And the user experience is is so important when you're trying to get family members onboard for this type of thing. Yeah. Absolutely. Because it's already invasive enough, right, to ask somebody to use something like this in in place of their, you know, handwritten notes password or using the same password on every site. It's already invasive to their workflow. They're adding a step into whatever they're doing. So you gotta make it as smooth and as easy as possible. And I I, again, likewise, I,

Anything anything sensitive in Bos has gotten so good. So for for years years, you had to, like, quit the app, go to the app, copy the password, come back, open the app, paste it in, and and that was just like a bad workflow that I didn't like. So I things like Netflix that you have to share with Sanity and whatnot, but I've pretty much entirely moved over to just if you save that QR code or you save the number that's in the QR code, you can always readd these to other things. So if you were to lose everything but you still have that QR code printed on paper, you could just open another authenticator app, add it, and it would give you the code that you need. Yes.

Courtney has forgotten her master master password twice Node. And Kayla's did too. Very frustrating.

family members that will allow a reset, which is good. And then you can also, like, I I LastPass, I forgot mine once. And, but luckily, I had the Chrome extension installed, and it, like, verified it based on that, which is good as well.

feature is a feature that tells you which of your passwords have been included It's not Apollo GraphQL because I saw Apollo on here, and I was like, holy cow, did Apollo GraphQL Plus allows you to host everything

and they say, screw this. This is too hard. It doesn't work. Yeah. It doesn't work all the time. It's annoying. Password.

on, these 2 sites, and you should probably do you should probably change that. It's also good. It tells you which ones are weak, which ones have been hacked, which ones are unsecured, which ones aren't using 2FA that should be using 2FA. We're gonna be talking a little bit more about 2FA in just a second. So use the watchtower. It's really, really useful feature.

For those of you who are sitting available with the computer right now,

which I'm sure you are as well.

Node it say a number? Mine's 16 breaches.

to unhash them Yeah. I do that as well. I'm gonna talk about this little generation

Patreon yeah. Patreon, who are you, and what

I would say head to have I been phoned in the show description, enter your email

I am acutely aware of the consequences which means that you need 2 factors But before we can let you in, before we know it's actually you, we need this six digit code that you need to enter. There's several services. Authy is probably the biggest one. Google Authenticator is also really big. I would recommend using something called Authenticator email addresses, usernames, and hashed passwords using sh a one and a small number using bcrypt.

the m d five hash of a common word will always be the exact same hash.

billions of data points publicly exposed without a password.

or to generate a hash of words and and match them. That that is definitely possible, especially with probably the biggest hashing algorithm out there JS MD 5 that's used,

Deno. We don't delete accounts.

So you people are still able to to reverse engineer those. What's, really fascinating about have I been pwned is that it gives you quite a bit of information about the hacks that took place for each one. Yeah. So you can get a good amount of information whether or not it has been a hashed,

I'm in Bitly,

Discuss.

usually, what happens is that, like, a database dump is taken or something like that, and they get access to your username. And, usually, in in best case, your password is hashed, It's annoying.

And if you use a common password, For years, I use this approach, which was first thing you do is you make a sentence.

Okay. They said they can't do it for tax reasons. I think that was a BS answer. Oh, yeah. Yeah. They have to, like, tie the the purchase to a actual person because Interesting.

password management,

of this. And to be honest, I don't know if you've ever been to Have I Been Pwned, which we'll link in the description.

and what it was hashed with. Alright. Was it Bitly? They gained access to 9,300,000

Adobe, Dropbox, Imager, Kickstarter, LinkedIn, generally, the codes live on your phone.

a a email service Peace.

MyFitnessPal, MyFitnessPal, blood ID, So I forever had been using I used Authy initially,

Did you ever use the service Apollo? And, this is vitally important Cannot read property ID of null, which means, and and back it up in your, like, Google Drive or whatever.

which I'd imagine most of you are because a lot of people are at home right now Yeah. Or in the office or not driving,

because I'm horrified at at all of these things. What it is is a listing of every time your email has shown up in a password breach. How many does your show up for? A lot.

So anytime

were you thinking? This is a sales tool or a data prospecting. So what they do is they, basically, this being on a larger scale. So, which, I argue that's a very good way to do it because then you're not giving some random company your all your passwords. I should also say, like, 1 password is not I put a funny middle name on there, and then you can see where that data trickles through and who's bought it. Smart. And that's that's kinda what they do JS they sell your data, which is these are awful companies. Wes, the security researcher here.

this is one of the reasons Wes Patreon got hacked, I emailed them and said, hey. Can you delete my account from your service considering you're not,

which it's possible that they save that in it, but that's still not a good good, Awesome. So please send this podcast to family members, anyone that

Discuss is a commenting service.

Okay. Apollo, should be stored in your password manager. And, also, you can group them. You can organize them. Like, we have ours grouped by entertainment so that I can share the entire entertainment folder with Courtney rather than, like, having to share each Node individually or whatever. Here's all of our, you know, YouTube whatever log ins. Here's all of our shopping log ins. Here's all of our personal finance log ins. And then I have my, like, level up tutorials logins that I can share with the team members, people who are using this thing, that aren't me. You know? I find it very, very valuable in those sort of ways. Absolutely. But it's it's a little bit of work to to get up and running, but well worth it.

process to do anyways. But they are are hashed, meaning that it's very hard if I ever wanna move to another provider, I have to call them up. They they took a recording of my voice, which Jeez. I guess they have used voice recognition, You have to turn off 2 background on every service. So what I'm doing is every time I log in to a website, I move it over and then delete it from Google Authenticator.

getting good at passwords, I

clear text.

Mine's 23.

in the have I been phoned search bar, hit enter, and then just be kind of horrified triple locked door with a secret key. They might have that, but who knows? For the I have a a little note here. It says, for the love of God, do not forget your master password

get hacked for some reason, and it's Scott. I never used it, but mine's in here as well. So what's up with that? Yeah. Because mine is in here, and it says Apollo left a database containing

this is a holds a special place in my heart because,

securing your database or whatever? And they're like, no. We can't do that. And I was just like, what?

for every service or anything that you do online. It's extremely important.

It's pnpm essential service in my mind. So That's cool.

searching events, users, tags, and everything else, allowing you to see not because I've been hacked or anything, I have not, but

speaking of hygiene, you're gonna make sure your application But having a generated password, something that's

Welcome to Syntax. In this very secure Totally. Yeah. And, again, any anything that gives that opportunity, do it because it's so much faster.

Sentry is adding new features LastPass for a little while, and she always hated it. She never wanted to use it because of it. I hated it, and I knew I needed to use it, so I still did anyways. But, just a just a heads up there.

And that's why we use a service like [email protected].

and then

Now Sanity is the bug pnpm error handling exception

Now you're gonna wanna sign up, use the coupon code tasty treat, all lowercase, all one word, and you're gonna get 2 months for free of this fantastic service.

no more bug. I mean, that's really, really the, the end result of this all. Looks like this this is a bug that just popped up, and it just popped up with the latest release. Not only that, but I can actually I can, I can write a test for this bug to make sure it never comes back and that we don't have any regressions, which, of course, you could track on the Century as well? So check it out at century.iocouponcodetastytree,

that you have gets stolen, used, or accessed without your knowledge.

Yeah. Totally.

all lowercase, all one word. You absolutely will not regret adding this to your application.

password management hygiene.

not logical, not a sentence, not a dictionary word, not a dictionary word with some, you know, threes swapped out for e's or something. Exclamation mark and a one to the end? Oh.

farms of human beings trying, one of the most interesting podcast episodes I've ever listened to.

use this new or not.

It doesn't do anything. Right. Yeah. Because they're they're if their service can check for, you know,

Why are they all so bad? Because the custom ones on Android are great. Oh, that's that's a good question. They are not just skinned versions. They are their own, and you can tell that they're their own thing because they are not that good. Well, the Ios one's the worst one of the bunch. It's the worst one of the bunch. Okay. So I like the Ios. Anyways Rant over. We do Sanity Ios rant on another episode.

The whole sentence based password thing, that's a a a good way. We'll talk a little bit about that in a second. But for the most part, I think it's the easiest to rely on a password to get this reset, this thing that is generating all of these codes. So Authenticator Plus is my pick. There's an Android version. There's an Bos Vercel. So both of you are covered. And, you know, the coolest thing about Authenticator Plus for me, besides the fact that I can import and export and take these with me to various devices or backup somewhere

of what it is. Right? If it's through the browser, through a service of which we'll talk more about,

Yeah. So using a password manager, you go ahead and you sign up for this, and you install it in your browser. You install it on your phone.

Yeah. And I always I I still I really dislike the Ios keyboard.

then that immediately, bots will try those passwords worth of McDonald's.

And, like, the Android keyboard, if if you didn't like something like that that Wes, like, sort of keyboard integration, somebody would just come out with a better keyboard, and then everyone would use that. So, like, the competition over like, the Bos keyboards are just, like, skinned versions of the iOS one. It's it's, like, not Node. They're not. No. They're they're so great. Are they so bad?

password, they're gonna be able to check you know, this is absolutely number 1 super big concern doing anything online.

If you reuse the same password on multiple websites,

Then you go ahead and decide on casing of that. So do you want a camel case it? Do you want a lowercase? with that under a thing, I said, oh, okay. I'm gonna start moving like, how do you actually set a a good password and and what tools should you be using? So regardless of what you do, you absolutely must have a unique password for every single website, and this is probably the one that gets absolutely everybody.

And it was such a pain to get those charges

as soon as that password is found out on any of these websites,

method I do. However, I don't use this method anymore

So, again, So let's talk about 2 FA, which stands for 2 factor authentication,

random generated strings, which is I I probably would say this is what everybody should be using these days. Yeah. I totally agree. You wonder why I like Android so much. Android's always had good integration with that kind of stuff, especially It was awful on Bos for years.

one example is you could take the 3rd letter of the domain name, Hey, everybody. I'm actually really excited for this episode because this is a question that I get from my friends and family as well as web developers Vercel.

So make a sentence. I love to eat pizza. That's the sentence. Right? So that's your base password.

I love to eat pizza and replace it with the 4th letter of the domain Node. Mhmm. And then you could count the number of letters in the domain name and add that to the end. Oh, my geez. You are every single website like, it it seems complicated, but as long as you say, I have a system. I love to eat pizza JS my base password, and then I always know that the third letter is replaced with the 4th letter of the domain I'm trying to sign ESLint.

Bos Yeah. Yeah, botnets doing it or,

and I had reused the same password on McDonald's as I had used on And then about 10 minutes later, they went and bought a $120 and it will give you the Node, which you can copy and paste. Or in most cases, it autofills the code for you

reverted because it wasn't like credit card fraud. I couldn't call my credit card company saying, like, someone stole my card because they hadn't. They had just got access to my McDonald's account. Right. And they just went up and and ran the ran the thing. So that's case in point, a place where you should never reuse it. It's not that your password is not guessable.

you're most likely not going to want to just invent a password Vercel. Because if you can remember it that easily, chances are it's not a great password. Now there's some exceptions to that.

since the password management integration that's actually a a good reason right there in itself. Yeah. Right? It's on a big discount, but You can also do text message 2 factor authentication. So you sign in, and it will text you a code.

for how you generate your password based on I use the domain name of the website. So they wouldn't give her her phone number back for, like, 7 days because they, like, trust nobody in this case.

generator regardless

generating a new password, how do you generate a password? And and I keep using the word generate a password here because

And then the number of characters in the domain name is just added on to the end or to the start or in the middle or whatever it is. And then you can say, okay. Knowing these 2 rules, you always have to remember those 2 rules. You can generate a unique password and remember a unique password for for any single one. So I, that worked forever for me. It worked really, really well. I still use it on some meaning that it's it's not if your password is dogs, it's not sitting in the database as dogs. Although that does happen, that's being called,

Bos, and Scott, el toroloco,

Open wide dev fans. Get ready to stuff your face with JavaScript, CSS, Node modules, barbecue tips, get workflows, breakdancing,

soft skill, web development, the hastiest, the craziest, the tastiest web development treats coming in hot. Here is Wes, barracuda, Monday. Monday. Monday.

Tolinski.