Received e-mail with my password in the title
Discussion
Hi - can someone give me some advice please? This AM I have received an e-mail from a random outlook account the title of which is a login id and password which I have used on quite a few things. Can’t really follow why. It’d take some doing to figure out everything that uses this password but I guess that’s what I need to do and change them all? Just don’t get why they’d send me such an e-mail?
djohnson said:
Hi - can someone give me some advice please? This AM I have received an e-mail from a random outlook account the title of which is a login id and password which I have used on quite a few things. Can’t really follow why. It’d take some doing to figure out everything that uses this password but I guess that’s what I need to do and change them all? Just don’t get why they’d send me such an e-mail?
All of the stuff above about a password manager.Make sure your email account is secured properly now.
Strong password, multi-factor authentication if they support it.
Email is the gateway into most peoples online lives so if you do happen to be using a crap password for it that you re-use elsewhere you need to change that habit
I once signed up for something online, and they emailed me my username and password.
I was distinctly unimpressed for a couple of reasons;
1) emailing credentials? Really?
2) that they even knew the password is a concern. That means they’re storing it somewhere, which means it’s likely to leak and then you get the fishing emails mentioned above.
Salted hashes exist for for a reason, and have been standard practice for a couple of decades at least. There really is no excuse for poor server side security these days.
I was distinctly unimpressed for a couple of reasons;
1) emailing credentials? Really?
2) that they even knew the password is a concern. That means they’re storing it somewhere, which means it’s likely to leak and then you get the fishing emails mentioned above.
Salted hashes exist for for a reason, and have been standard practice for a couple of decades at least. There really is no excuse for poor server side security these days.
This site will show you all the sites which have been compromised with your email address. All the known public breaches anyway.
https://haveibeenpwned.com/
https://haveibeenpwned.com/
As mentioned above always use unique passwords and remember longer passwords are always better. If a password is more than 12 characters long and is a combination of letters, numbers and characters that’s most ideal. Alternatively a long pass phrase (which isn’t commonly used) with some numbers and at least one special character should suffice I.e. GiantDogJump(+numbers & special characters). Humans can more easily remember these rather than a random string.
Remember passwords that are hashed can still be cracked if they are short enough. Anything 8 characters or less is very easy. Salting helps but still is able to be defeated if the password is short enough.
I completely agree with the use of password managers when possible as they allow for long, unique passwords to be stored without worry of forgetting them.
Finally, where possible use two factor authentication (also referred to as 2FA). This should be enabled for sensitive accounts, like email accounts, bank account access and anywhere you stored your card details like eBay, Amazon etc. Two factory works by requesting you enter an additional access code I.e. a text message or code from something like google authenticator. Text message is the weakest method of 2FA but is 100 times better than no 2FA. With 2FA even if someone gets your email address and password they still won’t be able to login without the access code, this makes it infinitely more difficult to access your account and will stop over 95% of these types of breaches. It is worth mentioning the site could still be hacked which could allow access to your account but with a strong, unique password and 2FA you’ve done as much as you can from a credential perspective.
Finally change every password after a breach like you’ve had and also sign up your email address to have I been pawned which is a free service that monitors the dark web for stolen/leaked passwords and alerts you if your email address turns up in one of their lists. It’s also worth putting your email address in the search now to see what, if anything it finds. It’s worth remembering they search for credential breaches but won’t know about all of them that are out there as they got sold in many black market sites.
https://haveibeenpwned.com/
Bonus tip: try to not store your credit/debit card details on sites that may not be able to protect them as well as eBay/Amazon etc. Where possible I use a paypal payment method for any non major site as it means they won’t ever see my card. Even if they don’t store your card, they will have to process it which could still compromise your card, hence PayPal is usually far safer in that context.
Remember passwords that are hashed can still be cracked if they are short enough. Anything 8 characters or less is very easy. Salting helps but still is able to be defeated if the password is short enough.
I completely agree with the use of password managers when possible as they allow for long, unique passwords to be stored without worry of forgetting them.
Finally, where possible use two factor authentication (also referred to as 2FA). This should be enabled for sensitive accounts, like email accounts, bank account access and anywhere you stored your card details like eBay, Amazon etc. Two factory works by requesting you enter an additional access code I.e. a text message or code from something like google authenticator. Text message is the weakest method of 2FA but is 100 times better than no 2FA. With 2FA even if someone gets your email address and password they still won’t be able to login without the access code, this makes it infinitely more difficult to access your account and will stop over 95% of these types of breaches. It is worth mentioning the site could still be hacked which could allow access to your account but with a strong, unique password and 2FA you’ve done as much as you can from a credential perspective.
Finally change every password after a breach like you’ve had and also sign up your email address to have I been pawned which is a free service that monitors the dark web for stolen/leaked passwords and alerts you if your email address turns up in one of their lists. It’s also worth putting your email address in the search now to see what, if anything it finds. It’s worth remembering they search for credential breaches but won’t know about all of them that are out there as they got sold in many black market sites.
https://haveibeenpwned.com/
Bonus tip: try to not store your credit/debit card details on sites that may not be able to protect them as well as eBay/Amazon etc. Where possible I use a paypal payment method for any non major site as it means they won’t ever see my card. Even if they don’t store your card, they will have to process it which could still compromise your card, hence PayPal is usually far safer in that context.
Edited by Scobblelotcher on Saturday 7th September 09:47
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff