PSA Change your passwords. Use secondary authentication.

[djberta]

Huge hack of multiple companies has exposed 16 billion profiles and passwords. Change all your passwords and make sure secondary authentication is activated. One step further is to use a physical passkey.

16 Billion Apple, Facebook, Google And Other Passwords Leaked — Act Now

As 16 billion credentials are confirmed as having been leaked, is it time to switch from passwords to passkeys?

www.forbes.com

 

[skippyelwell]

Whew, It will take them a while before they get to mine.

 

[Elektrishun]

I was reading about it here:

Tom's Guide

I have never used this service but in the article it is suggested to do the following:

"Second, to find out if your login credentials have been affected, use Have I Been Pwned and check if your email is in the clear."


A little irony when it appears that people who use VPN services may have had their info stolen.

 

[Susquatch]

A little irony when it appears that people who use VPN services may have had their info stolen.

A VPN does nothing to protect your passwords or login credentials. All it really does is hide your location and encrypt your traffic.

 

[Elektrishun]

A VPN does nothing to protect your passwords or login credentials. All it really does is hide your location and encrypt your traffic.

I realize that.

Just that people who are using an online security service are potentially breached through the very same service.

 

[Susquatch]

I realize that.

Just that people who are using an online security service are potentially breached through the very same service.

I see. But I don't follow what you mean. I can be pretty thick sometimes.

 

[Elektrishun]

Tried my 2 emails using the service Have I Been Pwned.

My main email came back negative.

The other had 2 "Data Breaches" from 2018. I have changed my passwords a few times since 2018.


Found this:

"A hacker has managed to phish Troy Hunt, the creator of HaveIBeenPwned.com, tricking the security expert into clicking a malicious email while he was jetlagged.

The breach affects people who subscribed to Hunt’s personal blog, rather than HaveIBeenPwned, a data breach notification site that’s attracted millions of users. “I'm enormously frustrated with myself for having fallen for this, and I apologize to anyone on that list,” he said."

Full Article

That guy is a web security consultant. Classic example of it can happen to the best of us.

 

[Elektrishun]

I see. But I don't follow what you mean. I can be pretty thick sometimes.

People are trying to be safer online only to have personal info stolen through an online security service.

Not the typical source of where you expect to get info stolen. While not impossible you'd expect they'd be a tougher business to hack being that internet security is what they do.

 

[Susquatch]

People are trying to be safer online only to have personal info stolen through an online security service.

I see. It wasn't obvious what you meant, but I see now and agree.

Sometimes when I am checking my email, I am truly shocked at what these characters do to try and hook me. Some times very sophisticated - other times total idiots.

And then I get this genuine email from my bank - who say they never do that but did! When I called them on it, they didn't even apologize!

I am currently evaluating a token system because even two factor authentication is being hacked.

 

[architect]

I have a throwaway password I use across multiple whatever accounts that was part of a previous data breach. This whatever account/pass includes a Domino's Pizza account with no credit card saved. Last year, someone went into my account, ordered a pizza by redeeming my points. I'm usually on top of my emails but was with company at the time so saw the order 2-hours later, and the pizza was already delivered. The person even had to add a bit of cash to cover the extras because their order went over the point redemption. Domino's returned my points no issue and after a quick Google realized this hack was happening all over.

 

[Martin w]

I have first hand experience with fraud. We were taken for $78,000.00 a couple years ago. $28,000.00 was recovered. Well not recovered. Clients repaid what they had already paid in good faith.
Long story short. If one of your suppliers is hit with ransomware, always check your archives in email, always have two step verification and don’t deal with Toronto Dominion Bank!
Martin

 

[Susquatch]

If one of your suppliers is hit with ransomware, always check your archives in email, always have two step verification and don’t deal with Toronto Dominion Bank!

It isn't obvious to me why you recommend checking your archives in email? What is that all about?

 

[Martin w]

They were sending and receiving emails thru archives to my customers saying we were being audited and not to use the regular direct deposit. I don’t know anyone who checks email on archive. So we had no idea until it was too late. I don’t want to hear from folks here who say we should have done this or that. Just giving some friendly advice. Some of my clients are government institutions and they fell for it as well. They were not the ones who made up the fraudulent payments after the fact.Lol

 

[mickeyf]

I was a bit skeptical of this "16 billion passwords" in all the major media. I see nothing in The Register, which is usually right on top of this sort of thing. I did see mention on Tom's, who seemed to have the usual general cautions but no inside info.

But I'm still a bit puzzled in that for decades now "everyone" knows that you do not store raw passwords in any kind of database - you "salt" them and encrypt them so that anyone who gets access to your DB still only gets gibberish rather than meaningful passwords, and those also should not be readily associated with any username. But I'm been out of the software & DB business for a few years now, so perhaps AI/Quantum computing/fill in the latest newness means "yes they really did get 16 billion actual usable passwords and know whose they are and for what accounts...."

 

[Elektrishun]

I was listening to an interview with a former black hat hacker who said regardless of the best cyber security systems put in place as long as a human is somehow involved and accessible there will always be a way to circumvent the security.