are these in haveibeenpwned yet?
Researcher uncovers one of the biggest password dumps in recent history
Submitted 9 months ago by throws_lemy@lemmy.nz to technology@lemmy.world
Comments
KpntAutismus@lemmy.world 9 months ago
cdf12345@lemmy.world 9 months ago
About 1/3 had not been previously seen in the have I been pwnd database, that’s really crazy. Either this was a very new or private list of exploited accounts.
EarMaster@lemmy.world 9 months ago
The good thing (for me personally) is that only some very old mail aliases of mine are in this collection. Which means that using a password manager to create and save all my passwords for years does have a positive effect.
1984@lemmy.today 9 months ago
People really should use multi factor auth on important sites they rely on…
MDKAOD@lemmy.ml 9 months ago
Ya know, I have no issues with 2fa, but I watch older folks struggle with it for some reason. They can’t fathom the ‘magic’. But I don’t understand 2fa on utility websites that are only payment portals that obfuscate account numbers. Like “enable 2fa for account security!” why? Because someone who has found my credentials on the dark web might pay my bill?
TORFdot0@lemmy.world 9 months ago
They can use the information to try to send you fake invoices to try to scam you, or use your personal information to social engineer you or your relatives, attempt identity theft etc. Basic info-sec is still important. It’s like leaving the bathroom door open when you poop. It probably isn’t going to hurt you if you leave it open but its still probably a good idea to shut the door if its a public restroom
Lesrid@lemm.ee 9 months ago
I’m also trying to find the angle on it. Like with my ISP I guess someone could have my password but not necessarily my address? So from the ISP site they could peek at my address??? I’m not even sure it has my address unobfuscated but I figure it must somewhere, like “view this bill”.
KairuByte@lemmy.dbzer0.com 9 months ago
As long as that factor is auth app based, and not email/text/call/proprietary app I’m all in. If I need to go digging for the second factor for 5 minutes, I’m almost always going to turn it off. Texts emails and calls all get delayed regularly, and it’s super fun to have to sit with my thumb up my ass waiting 10 minutes for an OTP that was good for 5.
1984@lemmy.today 9 months ago
I think for email it’s essential, it’s critical that someone doesn’t make it into your email. Otherwise they can reset all your other passwords.
I have mfa on my account but I just click a checkbox after first time to not ask again. I’m still protected by it and don’t have to do anything until I clear my cookies (which I don’t for email).
stealth_cookies@lemmy.ca 9 months ago
Ideally they also support a hardware key. Not nearly enough websites out there support FIDO/Webauthn.
HubertManne@kbin.social 9 months ago
I wish more were like azure where you can get a phone call and hit pound
Akuchimoya@startrek.website 9 months ago
One time I had to use a website where the email 2FA expired in 30 seconds! I usually keep my email client open while my computer is on, but, come on, that was ridiculous.
autotldr@lemmings.world [bot] 9 months ago
This is the best summary I could come up with:
Nearly 71 million unique credentials stolen for logging into websites such as Facebook, Roblox, eBay, and Yahoo have been circulating on the Internet for at least four months, a researcher said Wednesday.
breach notification service, said the massive amount of data was posted to a well-known underground market that brokers sales of compromised credentials.
Hunt said he often pays little attention to dumps like these because they simply compile and repackage previously published passwords taken in earlier campaigns.
This isn’t just the usual collection of repurposed lists wrapped up with a brand-new bow on it and passed off as the next big thing; it’s a significant volume of new data.
When you look at the above forum post the data accompanied, the reason why becomes clear: it’s from ‘stealer logs’ or in other words, malware that has grabbed credentials from compromised machines.”
For added assurance, Hunt also checked a sample of the credentials to see if the email addresses were associated with accounts on the affected websites.
The original article contains 645 words, the summary contains 167 words. Saved 74%. I’m a bot and I’m open source!
hperrin@lemmy.world 9 months ago
bitwarden.com, 1password.com, lastpass.com, keepassx.org
Take your pick.
Tangent5280@lemmy.world 9 months ago
I feel like atleast one of these has been hacked at some point in the past, but I cant remember which.
hperrin@lemmy.world 9 months ago
It was LastPass, but the passwords themselves weren’t leaked. All of these encrypt the password.
1984@lemmy.today 9 months ago
Lastpass had lots of issues.
boatswain@infosec.pub 9 months ago
KeePass doesn’t store your stuff in the cloud; it’s all local storage. You can sync your encrypted KeePass DB in a number of different ways; personally, I go for SyncThing, but you can use Box or whatever.
fmstrat@lemmy.nowsci.com 9 months ago
Based on experiences helping people migrate away, I’d suggest removing LastPass from your list. See other replies for why.
hperrin@lemmy.world 9 months ago
I added a note. I personally use Bitwarden and would recommend it, but I didn’t want to give a biased recommendation. If, for whatever reason, one of the others works better for someone, just using an encrypted password manager is way better than not.
Sensitivezombie@lemmy.zip 9 months ago
I’ve had 1password for as long as I can imagine. Never failed me. Happy with it.
Ghoelian@lemmy.dbzer0.com 9 months ago
Only issue I have with 1Password is their Android app. It works great most of the time, except that they didn’t implement the Android autofill stuff correctly.
It sees Firefox as a browser and offers autofill suggestions for the websites just fine, but apparently Fennec isn’t on their allowed browser list or something. It just sees Fennec as another android app and doesn’t offer logins for the website I’m on, just ones that I’ve linked to the Fennec app.