iPhone Data Leak

[stevesingo]

This morning I was logging on to another car web forum and my iPhone gave the following message:



How do they know?

When was the leak and from where?

When were they going to tell me?

Anybody enlighten me?

[bigandclever]

Welcome to iOs14

Edited to add this is probably more helpful

https://9to5mac.com/2020/07/04/ios-14-icloud-keych...

Good clickbait thread title though

Edited by bigandclever on Saturday 10th October 13:01

[xeny]

stevesingo said:

How do they know?

When was the leak and from where?

You may find the FAQs here helpful:

https://haveibeenpwned.com/FAQs

different company but a shed load of username/password combinations are essentially in the public domain.

[Mr E]

Yup. It’s the OS telling you at that the password you’re using has been found in a list of ‘known’ usernames/passwords on the web.

There are many websites that don’t do security properly. Or at all.

Change it. Change it now.

iOS will also tell you how many times you’re reusing the password, which is a little embarrassing.

[Mr Whippy]

Good feature really.

Apple are evil buggers wrt ring fencing users options, but they do seem to do right by them in securing their stuff.

Keychain encryption on iPhone is safest place for passwords for most people.
Just make sure iTunes backup is encrypted otherwise keychain contents aren’t backed up.

[Tycho]

Lastpass and Chrome do the same AFAIK.

[stevesingo]

Gromm said:

The subject line should really read - iPhone data leak warming

/pedant mode off

Are you sure? "warming"?

/pedant mode off

[ThumperMc]

Gromm said:

The subject line should really read - iPhone data leak warming

/pedant mode off

[h0b0]

Mr E said:

There are many websites that don’t do security properly. Or at all.

Yes, the most obvious one being.......Pistonheads. Only relatively recently did they stop sending passwords as plain text. I still have a pistonheads only password as a result.

[wombleh]

Best to get a password manager and have unique ones on every site, you never know which will get popped and as the existence of sites like havineenpwned shows, a lot do!

[Mr E]

h0b0 said:

Yes, the most obvious one being.......Pistonheads. Only relatively recently did they stop sending passwords as plain text. I still have a pistonheads only password as a result.

Yup. Pretty unforgivable frankly.