16 billion passwords leaked -- you are affected - Page 1
Forum section: electronics / general

author: u666sa
author_rank: Frequent Contributor
timestamp: June 20, 2025, 12:56:20 am
content: 2 passwords for every human on earth. Affected systems are Apple, Facebook, Google and other social media accs. Basically your iCloud password was leaked you have to change it, and your Gmail password was leaked you have to change it. You have to assume it was leaked.https://www.yahoo.com/news/16-billion-passwords-apple-facebook-203204594.htmlI have to assume my secure password I used for years and years, for gmail and whole bunch of other accounts is compromised.

author: UnijunctionTransistor
author_rank: Frequent Contributor
timestamp: June 20, 2025, 01:04:43 am
content: Anyway, just like washing your hands regularly regardless whether you have taken out the trash or not, good internet hygiene means updating your passwords regularly.

author: xrunner
author_rank: Super Contributor
timestamp: June 20, 2025, 01:24:43 am
content: *** yawn ***So what if they have my Google password (or Apple PW) they can't use it to log in because they can't authorize it from a secondary device which they don't have.

author: Psi
author_rank: Super Contributor
timestamp: June 20, 2025, 01:49:58 am
content: Good time to check you have two factory/ authenticator app enabled on all accounts.And make sure you have some backup codes.

author: Halcyon
author_rank: Unknown
timestamp: June 20, 2025, 01:58:22 am
content: Quote from: xrunner on June 20, 2025, 01:24:43 amI'm glad this is boring to you, it's boring to me too. But most people aren't as secure as you and I, but they should be. There are still people who bitch and moan about MFA and refuse to use it until they are dragged kicking and screaming.Quote from: UnijunctionTransistor on June 20, 2025, 01:04:43 amI tend to disagree. You should almost never need to update your password, if it's a strong one and it hasn't been leaked. MFA is far more important. Even Microsoft recommend not forcing users to reset passwords regularly as it leads to complacency and laziness. "EEVblog-is-the-tits!" is a far better password than "Dogsname1, Dogsname2, Dogsname3". Most of the big password managers will check credentials against known breaches and alert you to change your password (something even a few forum users here complained about as being a "bad idea" in the past, which I had to laugh at).

author: xrunner
author_rank: Super Contributor
timestamp: June 20, 2025, 02:09:29 am
content: Quote from: Halcyon on June 20, 2025, 01:58:22 amI'm going to check in with my senior citizen neighbor across the street tomorrow and make sure he's got MFA set up. Otherwise I'm not at all worried for myself.

author: Analog Kid
author_rank: Super Contributor
timestamp: June 20, 2025, 03:17:00 am
content: Quote from: xrunner on June 20, 2025, 02:09:29 amGood for you; take a few attaboys out of petty cash.

author: Halcyon
author_rank: Unknown
timestamp: June 20, 2025, 03:23:56 am
content: Quote from: xrunner on June 20, 2025, 02:09:29 amGood on you!My recommendation is, for people who just can't wrap their head around technology is have MFA and unique passwords on the important stuff (email, bank accounts, superannuation or investment accounts, etc...). For everything else, I suppose some kind of risk can be accepted.

author: MapleLeaf
author_rank: Contributor
timestamp: June 20, 2025, 01:59:05 pm
content: Haven't passwords been hashed by everybody for the last 60 years?

author: madires
author_rank: Super Contributor
timestamp: June 20, 2025, 03:06:03 pm
content: Quote from: MapleLeaf on June 20, 2025, 01:59:05 pmWishful thinking. The reality is that even today some online shops save credentials in clear text. Also, old hash algorithms like MD5 or SHA-1 should have been phased out because of security concerns.

author: felixd
author_rank: Regular Contributor
timestamp: June 20, 2025, 03:18:37 pm
content: One, good, main password for password storage and random password for every placehttps://keepassxc.org/https://random.flameit.io/password/

author: madires
author_rank: Super Contributor
timestamp: June 20, 2025, 03:23:36 pm
content: Quote from: u666sa on June 20, 2025, 12:56:20 amIt's just a collection of data from multiple breaches/leaks, some are quite old. No need to panic.Quote from: u666sa on June 20, 2025, 12:56:20 amUsing the same credentials for multiple services is a bad idea anyway. Install some password manager and create a dedicated good password for each service/shop/whatever. For critical stuff enable MFA (hardware token, TOTP, ...). Several platforms are pushing passkeys, but they come with a few disadvantages. So I would stay away from them if possible.

author: SteveThackery
author_rank: Super Contributor
timestamp: June 20, 2025, 03:24:43 pm
content: Quote from: felixd on June 20, 2025, 03:18:37 pmYep. It's 1Password for me.

author: UnijunctionTransistor
author_rank: Frequent Contributor
timestamp: June 20, 2025, 04:59:32 pm
content: Quote from: SteveThackery on June 20, 2025, 03:24:43 pmIt definitely beatsAdmin1

author: u666sa
author_rank: Frequent Contributor
timestamp: June 20, 2025, 05:05:27 pm
content: Quote from: Psi on June 20, 2025, 01:49:58 am

author: xrunner
author_rank: Super Contributor
timestamp: June 20, 2025, 05:35:51 pm
content: @u666saThe institutions I have 2FA with are NOT scammers or trying to get personal information I don't want them to have. Like my financial institution - I WANT them to have my phone number!Even the guy in the video says there are legitimate reasons for 2FA via phone number.

author: Monkeh
author_rank: Super Contributor
timestamp: June 20, 2025, 05:50:47 pm
content: 2FA does not imply giving up a phone number.

author: Psi
author_rank: Super Contributor
timestamp: June 21, 2025, 03:56:17 am
content: At the very least, install google authenticator on phone and enable it on all your google accounts.And print out some backup codes while you're there and file them away somewhere safe.

author: hans
author_rank: Super Contributor
timestamp: June 21, 2025, 07:52:54 am
content: Quote from: Halcyon on June 20, 2025, 01:58:22 amAdvocate of devil: Microsoft has some weird ideas on security. They also have 'passwordless signin', because "booooh! passwords can leak and are evil". They end up sending you a 2FA code ONLY which you then have to enter to login. 6 digit code, thats it. I saw my MS account was getting bullied with hundreds of random login attempts from random locations (mostly south america and africa) per day. I'm guessing 10^6/2/100=500 days is worthwhile to break into someone's account (imagine doing this to thousands of accounts in parallel)So passwords, even if they are "autoincremented" and therefore very semi secret, imo is better than Microsoft's idea of having nothing at all..But personally: get yourself a local Keychain software. Generate unique passwords for each site. You can set expiration reminders too. Keepass supports local TOTP generation too (no need for external authenticator apps), however, its debatable whether you should put your password and TOTP in the same keychain. Perhaps use an offline token generator instead.Also get backups for said keychain (don't lock yourself out).

author: Halcyon
author_rank: Unknown
timestamp: June 21, 2025, 09:12:26 am
content: Quote from: hans on June 21, 2025, 07:52:54 amI totally acknowledge what you're saying, and even agree. I'm not sure how I feel about this "passwordless" stuff that Microsoft is pushing. It's still early days, and I suspect will become somewhat of an administrative nightmare.My biggest issue is with the default way that Microsoft (and others) are handling logins. In my opinion, and I'm sure I'll get people disagreeing with me, is that your username should not be common knowledge, i.e.: Your email address is public information, you share that around, but your user ID or login to your accounts should be anything but you email address.I had a situation with an employee where for whatever reason, his M365 user account was being targeted. Multiple failed login attempts caused the real user to be locked out, several times, requiring IT to intervene. firstname.surname@domain.com wasn't hard to guess, but it led to a "denial-of-service type" situation.

author: madires
author_rank: Super Contributor
timestamp: June 21, 2025, 03:21:35 pm
content: Quote from: Halcyon on June 21, 2025, 09:12:26 amIt already is.Comes with vendor lock-in and managing multiple hardware tokens (or devices), in case you want some redundancy when one token breaks or is lost.

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 21, 2025, 03:41:09 pm
content: MS is pushing stuff that will make them money. That's all there is to it.So you'll basically go from a state where passwords are completely free (even if not 100% ideal from a security standpoint) to a state where you'll have to pay for your "tokens" to access just anything.That sounds nice.

author: themadhippy
author_rank: Super Contributor
timestamp: June 21, 2025, 03:55:58 pm
content: QuoteAs a monthly subscription.

author: madires
author_rank: Super Contributor
timestamp: June 21, 2025, 05:16:02 pm
content: ... for a cloud-based authentication service including outages from time to time.

author: Kjelt
author_rank: Super Contributor
timestamp: June 21, 2025, 05:26:12 pm
content: Quote from: hans on June 21, 2025, 07:52:54 amThat is not how it is supposed to work.First of all you need to request access before MS will send you this code.If someone from a new IP address tries to access your account you will get a notification email, I got this often when I was travelling on holidays.When you enter a wrong code the access attempt is nullified you have to start over.Then the code sent is time restricted, probably a few minutes before it is nullified again.When multiple attempts fail you will get notified. And if they do it correctly each attempt has to take twice as long so doubling the retry time each time making a brute force attack pointless.So calculate the chance that someone spoofing your IP address guesses the correct six digit code at one try within the few minutes timezone...

author: tom66
author_rank: Super Contributor
timestamp: June 21, 2025, 05:35:29 pm
content: Microsoft Authenticator is crap though, at least on iOS. It's very easy to get Teams and Authenticator both stuck in a loop with each other - Teams passes you to Authenticator, Authenticator says I don't have the token yet, passes you back to Teams, which then says wait I'm not authenticated, go back to Authenticator... I've ended up in that loop for a good five minutes before something seems to temper the behaviour.General TOTP 2FA things like Authy/Google Authenticator are very good indeed and I'd hope we have more companies starting to use them instead of SMS 2FA which is quite insecure (though any 2FA is better than no 2FA).

author: Psi
author_rank: Super Contributor
timestamp: June 22, 2025, 12:05:40 am
content: Agree about Microsoft Authenticator, even with Windows + Android it's sometimes annoying.

author: hans
author_rank: Super Contributor
timestamp: June 22, 2025, 08:34:05 am
content: Quote from: Kjelt on June 21, 2025, 05:26:12 pmThe request is as simple as entering my email address. I looked into my account and saw a gigantic list of failed attempts. I only got a single email of a request code, which was after many weeks of this shenanigans going on.My guess is (unless I stand to be corrected), that these people are bruteforcing requests with random 6 digit codes. Eventually one will be correct. They don't even care about the OTP email and its time restrictions.I guess if they do this with the correct thresholds to stay under IP ban limits they can keep doing this. (And obviously the cat and mouse game of staying undetected as a bot visitor). There isn't exactly a shortage of IPs or account e-mails to gamble with. Eventually they will hit jackpot and break into someone's account.This is FAR worse than an autoincremented password with OTP. Because, even if your password was leaked, how is an attacker going to know if you autoincremented your password how many times?I know its by far not best practice, but its not exactly like these scriptkiddies are going for high value targets. They all trying to get the low hanging fruit.

author: alex843
author_rank: Contributor
timestamp: June 22, 2025, 10:53:06 am
content: Some actual information from someone that knows more about security (and spotting AI generated articles) than most of us ever will.Probably the most important thing is don't use the same password everywhere, otherwise every account password is breached at the same time, and once they get one, they will try the same password on Microsoft, on Facebook, Google, Amazon, everywhere.Also, as mentioned earlier "Dogsname1, Dogsname2, Dogsname3" is not secure, and most brute force password guessing programs know that people tend to put the numbers at the end of the string, so don't do that.I'm usingKeePassXCon Mac and Linux and you can synchronise password databases on different machines withSyncthing.