Netflix - Language Keeps changing?! - Here's why....

[Andehh]

Last few weeks have had issues with my Netflix account changing the language to Spanish. No reason, no explanation. Each time I go and change it to English. After 3 weeks of this I finally contact Netflix.

They ask me if I have logged in From Peru, because that's where my account is being accessed from. In Spanish. My email address & password, used on a couple of android devices and an android box,

Turns out this chap has had access to my address, mobile number, email address, password, family names, viewing habits, times and every place I have logged in from for the last 4 weeks.

Netflix, after an hour on chat, are completely unfazed about this. Reset password, ask me to change my email address...then nothing more. Going as far as suggesting they have followed their due diligence, and see this matter as closed.

Anyone ever gone through this before? With nearly 2 decades of Online use, I am very savvy & very careful of my privacy. I feel properly uneasy knowing how much of my details have been bedtime reading for someone in Peru

[MrOrange]

Happened to me with a Netflix a while back, except the hack changed my password, too. The account had (probably) been compromised due to me password-sharing between more than one site - I think Yahoo was the suspect. I don’t do that anymore.

Worth checking your email addy on https://haveibeenpwned.com

[Andehh]

MrOrange said:

Happened to me with a Netflix a while back, except the hack changed my password, too. The account had (probably) been compromised due to me password-sharing between more than one site - I think Yahoo was the suspect. I don’t do that anymore.

Worth checking your email addy on https://haveibeenpwned.com

Interestingly enough, they sent me that site as well. Several sites over the last few years - including some big players - Linkin/Adobe etc - should know better!!

I also believe it was one of those sites who released my email & password, that was the same as what I used for Netflix.

Just annoyed Netflix didn't PERU(!?) as suspicious & hold my account until a text message/email confirmed it was me.

[Andehh]

Grr, few weeks on and it happened again. Very different password, everything logged in out, but once again I find language changed and account accessed from Peru.

How!? Hotmail password is as strong a they get, no sign of the dodgy activity there... But if don't get how we could have done it'll twice?

[anonymous-user]

Possibly a device you use to watch Netflix, or the device you did your password reset on, is compromised (malware, keylogger, whatever)

Update your antivirus / anti malware and do a full scan on those devices.

[Corso Marche]

There is every chance this other viewer was never signed out of your account. It's possible to change your NF password without signing any devices out. You have to select a checkbox to sign out all devices wherever they may be in the world when changing passwords.

And use a complicated password. My passwords are typically 16-digits in length, mix of numbers, symbols, & both upper-case & lower-case letters.
If it's a relatively straightforward word or phrase then any password cracking piece of code will crack it in a matter of hours.

[anonymous-user]

Corso Marche said:

And use a complicated password. My passwords are typically 16-digits in length, mix of numbers, symbols, & both upper-case & lower-case letters.
If it's a relatively straightforward word or phrase then any password cracking piece of code will crack it in a matter of hours.

Uh huh...... you might want to revisit that belief

[Mr Happy]

Nyphur said:

Uh huh...... you might want to revisit that belief

As good as the XKCD password comic is, entropy isn't the be all and end all of password security.

Yes, it will take longer than the earth has been around to crack if you start a, b, c... aa, ab, ac... and so on, but throw rainbow tables into the mix, dictionary based attacks with or without common substitutions and good old human fallibility and "dogflibblebumstealer" becomes a pretty normal password to crack.

And don't forget, the password is only as strong as the weakest link - if you do use "dogflibblebumstealer" as a password, and Joe Blow's tat emporium stores it in plaintext in their database, then if you use it on many different sites, believing it to be super secure - it just takes Joe Blow's tat emporium to be hacked, and you're back to square one.

In terms of password safety - the best advice is to not reuse passwords between sites, try not to have password patterns (sitename_password123 or similar) and wherever possible - enable two-factor authentication. Although not completely unhackable, doing this kind of thing would render a lot of information disclosure via password reuse pretty much null and void.

Something like keepass (https://keepass.info) is a good tool to have auto generate ridiculous passwords for you, because you don't need to remember them - it does it for you, you don't reuse an autogen password and you only have to remember the one (strong) password to unlock the vault when you switch your PC on.

[ging84]

Andehh said:

Just annoyed Netflix didn't PERU(!?) as suspicious & hold my account until a text message/email confirmed it was me.

It's an online streaming service, not a bank, if someone in peru downloads 5000 hours of content, it costs them almost nothing.
You really think they should put measure in place where you need to inform your tv company of your travel plans, in the name of protecting your privacy?

[Andehh]

First instance of this occurring it appears my email & password were hacked off an old forum i was part of it - fair cop, it happens. Netflix logged me out of everything & reset password. I changed password to one I could remember. Not bank grade secure, but securer then your average.

Now...the fact it has happened again is the annoyance for me.

I don't use Netflix on my computer or phone - only my TVs. It was a unique password to Netflix, not bank grade, but sufficient. All devices were logged out twice (Netflix& me). My email address uses a very good password, but otherwise looks untouched (password re-changed to be safe....).

Netflix will only go as far as suggesting I use a new email address, but otherwise are unable to comment/advise otherwise.

Any other ideas as to what could have happened? What i should be aware of?

ging84 said:

It's an online streaming service, not a bank, if someone in peru downloads 5000 hours of content, it costs them almost nothing.
You really think they should put measure in place where you need to inform your tv company of your travel plans, in the name of protecting your privacy?

Yes, I do agree, it's not a bank - however with my Netflix account he/she has my email address, mobile phone number, house address and names of my family members, as well as partial credit card. He also has the ability to view/access my viewing habits, which is not a big deal unless he was feeling pretty vindictive and queues up all the 18/Adult content Netflix has on its books and assigned them all to my daughters account - or to mine. Just to cause an awkward conversation or two within the family.

So whilst not a bank, it is pretty high up there on the sort of places that should have barriers in place to spot & limit unusual account activity.

[condor]

I was surprised to get a Netflix reset password request email this morning. I forwarded it to the Virgin media security team - but it doesn't appear to be a recent scam type email.
As far as I know, I don't have a Netflix account ( although Virgin media do offer Netflix) so didn't have a password in the first place.
Anyone else have similar?

[selnic]

Same here, I also have no Netflix account but am on Virgin. Looked like either spam or phishing to me, as there was a link to check recent activity which was requesting personal login details. Straight to the bin.

[mattley]

Given everything you've said the weakest link is probably your TV.

Samsung smart TV's especially were terrible for just sending stuff back to Samsung in plain text and as you can imagine there's a lot of money to be made for an employee selling stolen Netflix accounts.

[condor]

I've received another Netflix communication - this one is they couldn't take payment and so my subscription would be shut down. I've forwarded that to the virgin security team but there's no mention of recent Netflix scams on their forum.

[selnic]

Just had the same again.

[Turn7]

Had 2 emails from "netflix! this week....one asking me to log for some reason and another claiming payment failure....

Both fraudulent.