Apple: 'This password has appeared in a data leak'
Discussion
I seem to be getting regular notifications from Apple that numerous passwords of mine have 'appeared in a data leak' and should be changed.
I have just opened up the Apple Security Recommendations section on my phone, and it is showing that about 15-20 different passwords for varying things such as my Apple account, Dropbox, Instagram, and numerous sites I use, have all been 'leaked' and should be changed.
Is all this likely to be accurate? Do I actually need to act on all this and change about 20 passwords?
It also warns me that I have reused a number of different passwords, and that a whopping 69 other sites and apps need attention, but most are coming up as simply 'easily guessed'.
Totally guessing here: But I'm thinking that the issue is that I've used "Password1234" as an example, and that someone else in the world has also used "Password1234" and if Apple finds any of those examples of that same password leaked, it will inform me? Or is the strictly the case that MY username and password for various things has been leaked?
I have just opened up the Apple Security Recommendations section on my phone, and it is showing that about 15-20 different passwords for varying things such as my Apple account, Dropbox, Instagram, and numerous sites I use, have all been 'leaked' and should be changed.
Is all this likely to be accurate? Do I actually need to act on all this and change about 20 passwords?
It also warns me that I have reused a number of different passwords, and that a whopping 69 other sites and apps need attention, but most are coming up as simply 'easily guessed'.
Totally guessing here: But I'm thinking that the issue is that I've used "Password1234" as an example, and that someone else in the world has also used "Password1234" and if Apple finds any of those examples of that same password leaked, it will inform me? Or is the strictly the case that MY username and password for various things has been leaked?
Edited by anonymous-user on Friday 17th September 14:06
Ronstein said:
130R said:
This ^Results:
Adobe in 2013
Anti public combo list in 2016
Collection #1 in 2019
Dropbox in 2012
Guntrader forum in 2021
MyFItness Pal in 2018
Myspace in 2008 (
)Nitro PDF service in 2020
Online Spambot in 2017
Zynga Games in 2019
I've used the same email address for logging into pretty much everything for the past 24 years.
I used to use the same or similar password for most things, but not anymore. Whenever I change a password now it's random letters and numbers.
It will be that someone has used the password and it has been found in a leak. In turn this means it is likely to be in brute force dictionaries. So although your specific email / password combination has not been leaked, it would be a lot easier for someone to crack your password in the event that an encrypted version of your password was leaked.
Lord Marylebone said:
I seem to be getting regular notifications from Apple that numerous passwords of mine have 'appeared in a data leak' and should be changed.
Totally guessing here: But I'm thinking that the issue is that I've used "Password1234" as an example, and that someone else in the world has also used "Password1234" and if Apple finds any of those examples of that same password leaked, it will inform me? Or is the strictly the case that MY username and password for various things has been leaked?
Irrespective of what password you are using, it's clearly a commonly used one if it's being flagged up and as such, you should change them. Use a password manager and you won't have to remember them all (other than your master password to get into the password manager but that's a separate discussion around getting the balance right...). Totally guessing here: But I'm thinking that the issue is that I've used "Password1234" as an example, and that someone else in the world has also used "Password1234" and if Apple finds any of those examples of that same password leaked, it will inform me? Or is the strictly the case that MY username and password for various things has been leaked?
Edited by Lord Marylebone on Friday 17th September 14:06
acd80 said:
Irrespective of what password you are using, it's clearly a commonly used one if it's being flagged up and as such, you should change them. Use a password manager and you won't have to remember them all (other than your master password to get into the password manager but that's a separate discussion around getting the balance right...).
I don't usually have to remember any of them as the Apple password system remembers and auto-fills them for me on all my devices.But yes, I will start changing them. No reason not to.
I'd also strongly recommend using 2FA, even if only on critical applications like your email, password manager and financial accounts. Password breaches will happen more and more and having an extra, and not that inconvenient, layer of security is helpful in such events to prevent compromise.
Lord Marylebone said:
I've used the same email address for logging into pretty much everything for the past 24 years.
I used to use the same or similar password for most things, but not anymore. Whenever I change a password now it's random letters and numbers.
Use a different email address for everything. Either via your own catch all domain, or by putting +(plus sign) and then some random stuff at end of Gmail, outlook etc email address.I used to use the same or similar password for most things, but not anymore. Whenever I change a password now it's random letters and numbers.
Then the attacker needs to know both the email and password for any site
hyphen said:
Use a different email address for everything. Either via your own catch all domain, or by putting +(plus sign) and then some random stuff at end of Gmail, outlook etc email address.
Then the attacker needs to know both the email and password for any site
This with a password manager like Bitwarden that you can use to create the password too. You get different email address and password for all sites. btw the Gmail trick might not work with all accounts, I'd take a domain for this and route all emails into your email address of choice.Then the attacker needs to know both the email and password for any site
Assume someone somewhere will not take care of your password and go from there. If you don't have 2FA options for shopping sites, consider not storing your credit card there.
Without wishing to alarm you, I’d be a little bit concerned about the Guntrader leak if you aren’t already aware.
https://www.google.ch/amp/s/www.theregister.com/AM...
https://www.google.ch/amp/s/www.theregister.com/AM...
Lord Marylebone said:
Guntrader forum in 2021
This one was a bit more than just your email address and password mind.https://www.theregister.com/2021/08/31/guntrader_b...
https://www.theregister.com/2021/09/07/guntrader_h...
Gassing Station | Computers, Gadgets & Stuff | Top of Page | What's New | My Stuff