airgapped_alice@airgapped_alicePassword manager + 2FA is still the single highest-leverage thing you can do, and here's the nuance people skip
If someone new to this asks me for one piece of advice, it's a password manager with a strong unique master password, plus two-factor on everything that matters. That combination defends against the most common real-world attack by an enormous margin: credential stuffing, where a password leaked from one breached site gets replayed against your email and bank. The nuance that gets skipped: Not all 2FA is equal. SMS codes are better than nothing but they're vulnerable to SIM-swapping, where someone social-engineers your carrier into moving your number to their SIM. App-based TOTP codes are a big step up. Hardware security keys using the FIDO2/WebAuthn standard are the strongest widely-available option because they're phishing-resistant — the key cryptographically checks it's talking to the real site, so a convincing fake login page gets nothing. And your recovery paths are part of your attack surface. People harden the front door and leave the 'forgot password' flow wide open, tied to an email account with a weak password and no 2FA. Secure the account that resets all your other accounts first.
Join the conversation
Facet is free to read. To reply you need an account: one private root identity, and up to ten public personas that can never be linked to each other or to you.
Create an account
de_googled@de_googled· 7/5/2026, 3:58:57 AMThe recovery-path point is the one I wish more people internalised. Your email is the master key to your entire life — every reset link lands there. If that inbox falls, nothing else you did matters. Harden it like it's the crown jewels, because it is.
checksum_charlie@checksum_charlie· 7/5/2026, 6:12:27 AMand print your recovery codes. actually print them, put them somewhere physical and safe. I've watched more than one person lock themselves permanently out of an account because their 2FA lived only on a phone that went in a lake. availability is part of security too.
airgapped_alice@airgapped_alice· 7/5/2026, 8:27:19 AM100%. two hardware keys, not one — a primary and a backup registered to the same accounts, stored separately. the failure mode of 'I secured it so well I locked myself out forever' is real and it's demoralising enough to make people abandon the whole practice.
cipher_moth@cipher_moth· 7/5/2026, 6:51:15 AMFor most people's threat model, a good password manager plus app-based TOTP is already 95% of the benefit for near-zero cost. Hardware keys are worth it and I use them, but I never want someone to think 'I can't afford a key so why bother.' The free 95% is right there. Do that first, add keys later.
de_googled@de_googled· 7/12/2026, 4:32:41 AMreviving this because someone asked me offline: passkeys are the same FIDO2/WebAuthn idea Alice described, just wrapped in nicer UX and synced through your ecosystem. phishing-resistant by design, no code to type. for the average threat model they're a genuine step forward — the caveat being your sync provider becomes a trust anchor, so pick it deliberately.