711 million email addresses and passwords dumped.

touch said:
How are you so sure your password has not been leaked?
Click to expand...
As I don’t have accounts on those websites that leaked. Take Last.fm I have never used that site, my email address isn’t in use on that site either by me or someone else so how can my email and password be exposed from a leak?

Another one Heroes of Newerth: the multiplayer online battle arena game. I never sighed up. My email hasn’t been used in an account by someone else so again why is it listed as exposed?

QuinStreet is another one I have never used and there is no account. Like I said I don't trust the haveibeenpwnd website.
 
Seems my iCloud one is on the list, which would explain why it has become a SPAM hell over last 6 months. I use 2FA should I still change my password?
 
Is there a more reputable source? websites such as these might just be designed to get peoples email addresses so that they can be sold to spammers.
 
I checked and I had not changed my iCloud password since 2014 so thought it was about time. Now weeks and weeks of password resets as I have forgotten it already
 
Pottsey said:
As I don’t have accounts on those websites that leaked.
Click to expand...
There's loads of reasons why you might appear on a dump listed against a site you havn't used:
  • whichever hacker stole the passwords from last.fm also managed to access another site you use and merged his list of credentials together.
  • Hacker mislabeled file containing the data.
  • server which hosts a hacked site also hosts other sites which could confuse a hacker with which database they have accessed.
  • hacker lied about where the data came from.
  • There are subsites or alternative trading names under the main headline of the attack. For example, the 28 "predominantly technology forums" effected by the QuinStreet hack.
  • The dumped data may have been stolen from the original hacker and whoever published it doesnt actually know all the details of the hack. For example, the leaked data from the OP's link wasn't released by whoever harvested it. It was found in text files on a server which was also used by a spambot and associated with that spambot - a reasonable assumption but possibly has nothing to do with it.
 
Last edited:
Why this is going on I feel it may be a good time for someone to explain lastpass to me. How does it work what happens if I get locked out my own account or change or loose my phone etc? I'd like to use it for my email service, Facebook, Google services. All of which have 2fa but I would feel better if they all had unique passwords generated by software which makes abit of a scrambled password hard to guess.

Can it generate me a password I can view within the vault though for things I'd barely login too which are app based?
 
Unicorn said:
Why this is going on I feel it may be a good time for someone to explain lastpass to me. How does it work what happens if I get locked out my own account or change or loose my phone etc? I'd like to use it for my email service, Facebook, Google services. All of which have 2fa but I would feel better if they all had unique passwords generated by software which makes abit of a scrambled password hard to guess.

Can it generate me a password I can view within the vault though for things I'd barely login too which are app based?
Click to expand...
just do it.
only skimmed the video but seems pretty comprehensive.


change or lose a phone no issue, its on any device and on the web.
if you forget your master password you are screwed.
you can view login info on website or app
if you have app on the phone most apps can be auto filled, or you'll get a box where you can copy and paste
 
Just checked and one of my old O2 email addresses was done through Dropbox 5 years ago.

I can't remember when I deleted this account.
 
touch said:
There's loads of reasons why you might appear on a dump listed against a site you havn't used:
  • whichever hacker stole the passwords from last.fm also managed to access another site you use and merged his list of credentials together.
  • Hacker mislabeled file containing the data.
  • server which hosts a hacked site also hosts other sites which could confuse a hacker with which database they have accessed.
  • hacker lied about where the data came from.
  • There are subsites or alternative trading names under the main headline of the attack. For example, the 28 "predominantly technology forums" effected by the QuinStreet hack.
  • The dumped data may have been stolen from the original hacker and whoever published it doesnt actually know all the details of the hack. For example, the leaked data from the OP's link wasn't released by whoever harvested it. It was found in text files on a server which was also used by a spambot and associated with that spambot - a reasonable assumption but possibly has nothing to do with it.
Click to expand...
All of which makes haveibeenpwned almost useless. So there could be 1 leak 10 years ago but it reports 10+ leaks and keep rereporting every so often as an old obsolete password keeps getting relisted in new leaks even though its not been used in 10 years. Its like the Onliner Spambot August 2017 for the most part it’s just a giant email list. Changing your password does nothing.

While its good practise changing your password once every so often. It’s not good precise to use haveibeenpwned and basing passwords changes when it says there is a leak.
 
HIBP has lots of junk on it, use it for guidance only. The longer the site goes on the worse it seems to get. For example I made my dad a new e-mail account last year and it shows up as having been compromised in 2012, I have owned that domain since 1990s and the account never existed prior to 2016 so the account has never been compromised. I'm not saying there isn't a match for it in the database, but that's not this account.

Remember your e-mail address is not private and being public doesn't really change anything.
 
Wish it would provide more details says my email is listed, but not clear if its the password and what the website is. I have dozens, which ones to change?

Halfmad said:
HIBP has lots of junk on it, use it for guidance only. The longer the site goes on the worse it seems to get. For example I made my dad a new e-mail account last year and it shows up as having been compromised in 2012, I have owned that domain since 1990s and the account never existed prior to 2016 so the account has never been compromised. I'm not saying there isn't a match for it in the database, but that's not this account.

Remember your e-mail address is not private and being public doesn't really change anything.
Click to expand...

Remember how everyone's phone number used to be in a book? Your email is no different really
 
Last edited by a moderator:
Ugley_Matt said:
Remember how everyone's phone number used to be in a book? Your email is no different really
Click to expand...

It's funny because I've had to explain this to people at work and family, it's just an address and frankly could be guessed anyway :)

Ugley_Matt said:
Wish it would provide more details says my email is listed, but not clear if its the password and what the website is. I have dozens, which ones to change?
Click to expand...

It should say which breaches you are allegedly involved in, just ensure you have changed your credentials since and if possible have two factor authentication enabled where you can. Also make sure no passwords used previously are still in use on other sites.
 
Last edited by a moderator:
I've used that site before - and changed my password in the past. How do we know if the site doens't just have my previous email listed with the old password?

ps: I have 2step verification now too, so it should be all good now anyway
 
Supercow said:
I've used that site before - and changed my password in the past. How do we know if the site doens't just have my previous email listed with the old password?

ps: I have 2step verification now too, so it should be all good now anyway
Click to expand...
It tells you when the breach was. So it's not hard. Did you change the password after the breach.

I'm on the Dropbox breach but that was 2012 password has changed many times since then.
 
You must log in or register to reply here.
Back
Top Bottom