r/Passwords

I am being bombarded with Account Recovery requests. Bombarded may be overstating it a little bit, but I'm getting 3-10 requests a day and oftentimes 5 or 6 in a row. Of course I hit "No" every time it asks if it is me trying to recover.

I have Advanced Protection turned on. My phone set up as a passkey. I have an excellent password that is completely unique to Google. I also changed my password just to be safe. I've logged in and I recognize all of my connected devices.

I am pretty sure that I haven't been hacked, but I am being targeted. The messages that come along with the account recovery prompts state that my password hasn't been compromised, but the persistence of the hacker still worries me. It's been going on for about 2 weeks. I suppose the hacker is attempting to guess my passwords using old compromised ones bought off the web. I am mostly afraid of inadvertently hitting "Yes" to a prompt just one time and then I'm cooked. I don't THINK that completely opens me up, but I'm not 100% certain. I plan to get a physical security key, but I don't think that bypasses the Account Recovery prompts either.

Any thoughts or suggestions? Thanks.

A professional website I am on has asked everyone to change their password and it can be up to 255 characters long. Why allow such a long password?

Also they insist a character cannot be repeated, and upper and lowercase letters, numbers and special characters must be used. If a password is long enough it doesn't matter. Is their IT department out of touch with current NIST recommendations?

Of course I had to take advantage of this and used a password this length.

Hey everyone,

I built LeakGuard, an iOS app that checks if your password has appeared in known data breaches using the Have I Been Pwned database.

Why I built it:
Most people reuse passwords across sites. One breach = all accounts at risk.

How it works:
• Your password is hashed on-device (SHA-1)
• Only the first 5 characters of the hash are sent to the API (k-anonymity)
• The full password NEVER leaves your device

Features:
✅ Instant password breach check
✅ Secure password generator
✅ Check history (stored locally, encrypted)
✅ No account required
✅ No tracking, no analytics

Looking for beta testers to squash bugs and suggest features before launch.

Feedback welcome! 🙏

Love, Secret, Sex and God. A popular film depicts these as common used passwords. Would you ever use something so simple, even on a local account? Without exposing your "secret" password, what do you consider modern locally used passwords that would make a "gibson" easily "hack-able"?

Google added a flag in Chrome Canary where Gemini handles password resets automatically. If the browser detects a weak password, the LLM takes over, fills out the site reset form, and submits the new secret for you.

I had a good laugh reading through the details today. Giving an LLM active DOM access and password change authority across arbitrary web forms is an indirect prompt injection dream. Imagine a compromised website hiding malicious instructions inside an unrendered HTML block while the AI agent works through your account settings page.

Security nightmare aside, handing credential management over to a remote cloud model destroys personal autonomy. If someone needs an automated AI model to click two buttons and fix "Password123", they should not store passwords in a browser in the first place.

Source: SammyGuru, link in comments

Hi there,

I have a family with three kids and two jobs. I have over 200 passwords in 1Password with three vaults. I like 1Password, however, I have a bad feeling after price increases. I think 1Password goes more and more to enterprise customers.

I also use Bitwarden in the past with vaultwarden. It was a little bit clunky, but the test were 4 years ago.

TLDR: Which password manager is the best for a da with wife and kids and two jobs?

I need to login my friends account for something because she needs me to, I know you’re wondering why can’t she just give me the password. She’s in jail and she does not remember it.🤣How to hack?

I'm getting a daily notification to change my password due to unusual usage.