My Password Compromised
Discussion
For whatever reason I found myself looking in the junk folder of one of my email accounts this afternoon. There was an email with a password I used to use in the subject line so I took a look. The message was very badly written with several spelling errors but asked for money as I’d apparently used that email address and password to access hard pornography. I know I hadn’t.
It was/is blatant blackmail and if I’d accessed hard porn I’d never have used that password but how on earth did the buggers access it? I checked at https://haveibeenpwned.com/ , the email address had been pwned at my LinkedIn account and the password possibly somewhere else. I’m fairly sure that wasn’t my LinkedIn password.
How on earth do these guys get this information? I’m just peed off to see my password in an email from a gobs
te.
It was/is blatant blackmail and if I’d accessed hard porn I’d never have used that password but how on earth did the buggers access it? I checked at https://haveibeenpwned.com/ , the email address had been pwned at my LinkedIn account and the password possibly somewhere else. I’m fairly sure that wasn’t my LinkedIn password.
How on earth do these guys get this information? I’m just peed off to see my password in an email from a gobs
te.Breaches get released all the time, Adobe, Linkedin, Marriott, EasyJet, plenty of others, if you want to PM me your compromised email address I might be able to find out where it was breached, we hold our own database of breaches, but it's by no means comprehensive, only a billion or so records :-) It's really just an amalgamation of public records and if pwned doesn't have it we probably don't either.
If nothing now, try searching again in a few weeks, might not be public yet, although if it's badly written ste in your inbox it should be.
If nothing now, try searching again in a few weeks, might not be public yet, although if it's badly written s
te in your inbox it should be.I'd noticed on the Firefox email checker that LinkedIn had leaked info too.
I think I had about 3 or 4 fairly legit accounts with leaked data, and possibly some degree of password 'guessability'
So obviously if you use something like LinkedInpassword for linkedin, and then adobepassword for adobe, then anything but a basic bot/script scan of the leaked databases might figure out your other passwords.
It's the wild west out there. It's getting worse. I just set up a new email account alias with a random alphanumeric and password these days, store it all in KeePass, and use an email per account.
No leaks then. And you also find out specifically who is leaking if you only use that email account to interface an account.
I've pretty much stopped picking up the landline due to scammers. Mobile phones are now getting as bad. Emails are almost getting to whitelist levels too.
Go militant on the web. PiHole, Privacy Badger, uMatrix, segregated email accounts.
What is most worrying though is stuff like Win10. User account = email account = password gives access to everything on any machine, and probably credit card data etc too. Attack surface larger than the moon with all the junk ware.
If MS ever leaks then half the world is going to be shafted!
I think I had about 3 or 4 fairly legit accounts with leaked data, and possibly some degree of password 'guessability'
So obviously if you use something like LinkedInpassword for linkedin, and then adobepassword for adobe, then anything but a basic bot/script scan of the leaked databases might figure out your other passwords.
It's the wild west out there. It's getting worse. I just set up a new email account alias with a random alphanumeric and password these days, store it all in KeePass, and use an email per account.
No leaks then. And you also find out specifically who is leaking if you only use that email account to interface an account.
I've pretty much stopped picking up the landline due to scammers. Mobile phones are now getting as bad. Emails are almost getting to whitelist levels too.
Go militant on the web. PiHole, Privacy Badger, uMatrix, segregated email accounts.
What is most worrying though is stuff like Win10. User account = email account = password gives access to everything on any machine, and probably credit card data etc too. Attack surface larger than the moon with all the junk ware.
If MS ever leaks then half the world is going to be shafted!
Mr Whippy said:
I'd noticed on the Firefox email checker that LinkedIn had leaked info too.
I think I had about 3 or 4 fairly legit accounts with leaked data, and possibly some degree of password 'guessability'
So obviously if you use something like LinkedInpassword for linkedin, and then adobepassword for adobe, then anything but a basic bot/script scan of the leaked databases might figure out your other passwords.
It's the wild west out there. It's getting worse. I just set up a new email account alias with a random alphanumeric and password these days, store it all in KeePass, and use an email per account.
No leaks then. And you also find out specifically who is leaking if you only use that email account to interface an account.
I've pretty much stopped picking up the landline due to scammers. Mobile phones are now getting as bad. Emails are almost getting to whitelist levels too.
Go militant on the web. PiHole, Privacy Badger, uMatrix, segregated email accounts.
What is most worrying though is stuff like Win10. User account = email account = password gives access to everything on any machine, and probably credit card data etc too. Attack surface larger than the moon with all the junk ware.
If MS ever leaks then half the world is going to be shafted!
MS or Apple I’d say.I think I had about 3 or 4 fairly legit accounts with leaked data, and possibly some degree of password 'guessability'
So obviously if you use something like LinkedInpassword for linkedin, and then adobepassword for adobe, then anything but a basic bot/script scan of the leaked databases might figure out your other passwords.
It's the wild west out there. It's getting worse. I just set up a new email account alias with a random alphanumeric and password these days, store it all in KeePass, and use an email per account.
No leaks then. And you also find out specifically who is leaking if you only use that email account to interface an account.
I've pretty much stopped picking up the landline due to scammers. Mobile phones are now getting as bad. Emails are almost getting to whitelist levels too.
Go militant on the web. PiHole, Privacy Badger, uMatrix, segregated email accounts.
What is most worrying though is stuff like Win10. User account = email account = password gives access to everything on any machine, and probably credit card data etc too. Attack surface larger than the moon with all the junk ware.
If MS ever leaks then half the world is going to be shafted!
My password in this occasion was actually my forces service number which I’ll never forget but I’d be amazed if anyone else would know it.
if it was an 8 digit number, then its hash can be broken in under a second.
you might be interested to see what comes up when you google the md5 hash of that number
you can get it by putting it in to a website like this one
https://www.md5hashgenerator.com/
it will give you a 32 character hex string, copy that into a google search, chances are you'll see your email in some breach lists
you might be interested to see what comes up when you google the md5 hash of that number
you can get it by putting it in to a website like this one
https://www.md5hashgenerator.com/
it will give you a 32 character hex string, copy that into a google search, chances are you'll see your email in some breach lists
Mr Whippy said:
What is most worrying though is stuff like Win10. User account = email account = password gives access to everything on any machine, and probably credit card data etc too. Attack surface larger than the moon with all the junk ware.
If MS ever leaks then half the world is going to be shafted!
It’s highly unlikely that MS store your password anywhere! They will have a hash of some sort (which you can’t reverse to find a pwd).If MS ever leaks then half the world is going to be shafted!
I am actually surprised that so many “reputable” companies store passwords and not hashes etc.
One sign that a site/company has poor password management is when you forget your password and they send your original back to you! (Via e-mail of all mediums!!). They should not be able to do that really, and just do a password reset.
after they pass it on to the NSA and GCHQ, MS only keep the hash.On a separate note, I am sceptical about those “has my e-mail address been scammed” sites, how does one know they’re not just e-mail address harvesters for aforementioned scammers!! Same goes for password testing sites, a pin easy way to harvest common passwords, even worse if they can get your e-mail identity too!
Funk said:
This is why everyone should be using a password manager now, it's WAY more secure and a unique password for every site I have a login for. I use LastPass but others are as good or better, make sure you have 2FA enabled and a decently-long master password.
LastPass has had it's own problems! 2FA/MFA pretty much defeats this, agreed.toastyhamster said:
Funk said:
This is why everyone should be using a password manager now, it's WAY more secure and a unique password for every site I have a login for. I use LastPass but others are as good or better, make sure you have 2FA enabled and a decently-long master password.
LastPass has had it's own problems! 2FA/MFA pretty much defeats this, agreed.Dracoro said:
Mr Whippy said:
What is most worrying though is stuff like Win10. User account = email account = password gives access to everything on any machine, and probably credit card data etc too. Attack surface larger than the moon with all the junk ware.
If MS ever leaks then half the world is going to be shafted!
It’s highly unlikely that MS store your password anywhere! They will have a hash of some sort (which you can’t reverse to find a pwd).If MS ever leaks then half the world is going to be shafted!
I am actually surprised that so many “reputable” companies store passwords and not hashes etc.
One sign that a site/company has poor password management is when you forget your password and they send your original back to you! (Via e-mail of all mediums!!). They should not be able to do that really, and just do a password reset.
So just some malware that finds a gap on the vast attack surface that is Win10, say a key-logger... or whatever... it's going to be a bad day.
Considering a decade ago your windows machine had an admin account separate to your email/password, separate to your credit card stuff... all segregated.
MS had the opportunity to hide behind segregation being baked in. Today they have encouraged people to combine it all into one place, so they are 100% responsible if their software lets anything in and scrapes the lot out!
Dracoro said:
On a separate note, I am sceptical about those “has my e-mail address been scammed” sites, how does one know they’re not just e-mail address harvesters for aforementioned scammers!! Same goes for password testing sites, a pin easy way to harvest common passwords, even worse if they can get your e-mail identity too!
https://haveibeenpwned.com/Aboutbad company said:
MS or Apple I’d say.
My password in this occasion was actually my forces service number which I’ll never forget but I’d be amazed if anyone else would know it.
As above, a password consisting only of numbers can be guessed in no time at all. Change all your passwords asap if they're similarly weak and use 2FA wherever you can.My password in this occasion was actually my forces service number which I’ll never forget but I’d be amazed if anyone else would know it.
But don't worry about that email. One pain about having any email address for a long time is it's been breached many times thanks to the dreadful security of various companies, which means at one point I was getting one of those emails claiming they'd installed some spyware and recorded me on my webcam blah blah about once a week.
I see them in my spam folder and I've probably had over a hundred of them in the last couple of years but, as far as I know, they haven't released their sensational videos to all my friends and families.
...or they did and none of my friends or family found it very interesting
durbster said:
As above, a password consisting only of numbers can be guessed in no time at all. Change all your passwords asap if they're similarly weak and use 2FA wherever you can.
But don't worry about that email. One pain about having any email address for a long time is it's been breached many times thanks to the dreadful security of various companies, which means at one point I was getting one of those emails claiming they'd installed some spyware and recorded me on my webcam blah blah about once a week.
I see them in my spam folder and I've probably had over a hundred of them in the last couple of years but, as far as I know, they haven't released their sensational videos to all my friends and families.
...or they did and none of my friends or family found it very interesting
If you're anything like me, nobody knows what's happened in that 3 seconds of video But don't worry about that email. One pain about having any email address for a long time is it's been breached many times thanks to the dreadful security of various companies, which means at one point I was getting one of those emails claiming they'd installed some spyware and recorded me on my webcam blah blah about once a week.
I see them in my spam folder and I've probably had over a hundred of them in the last couple of years but, as far as I know, they haven't released their sensational videos to all my friends and families.
...or they did and none of my friends or family found it very interesting
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff