Sources are mentioned in the FAQ and top page: https://shouldichangemypassword.com/sources.php
It's checking the e-mails on those databases.
Should I Change My Password?
31–40 of 104 posts
Re: Should I Change My Password?
#32It'd be cool if they added an option to subscribe for $10/year for a quick SMS and email notification if your account is compromised. I'd get it for myself and my family.
Re: Should I Change My Password?
#33I was confused be cause I typed "password" into that box and it told me I was safe.
Re: Should I Change My Password?
#34Am I the only one that feels uncomfortable with these kind of sites? Anyway, I tried "abc124" and received: "It looks like your passwords may be safe. No instances of compromise are recorded in this database. However, it's good practice to change your critical passwords regularly and ensure they are not re-used across multiple sites."
You're supposed to enter your email address... lol. There's a reason the text box says "Enter email here" and the bottom of the page discussed the "email entered will not be...". Also, it just doesn't make any sense to search by password. Yes, I would be disturbed if a public site was reversing weak poor choices in hash algorithm and publishing data about the resulting passwords.
Well that's embarrassing. Yes, you're quite right, I read everything except that box and I the bottom text (which was just outside of my scroll view).
The only defense I can offer is that the name, introduction and the feedback text (which should at least check for "@") is kind off or misleading.
Anyway, my fault, I apologize to the web site creator.
Re: Should I Change My Password?
#35so, can someone answer this for me? I have a personal domain on google apps. The login ID is different than the email address I use/advertise. e.g. my username for login is first-initial+last-name@[domain].com But the email address I use for everything on that account is first-name@[domain].com This service states that my account was compromised on 12/12/2010 most recently at the first-name@[domain].com though you co…
I got the exact same date for my gApps-hosted domain. Odd.
That's the date of the Gawker hack.
Re: Should I Change My Password?
#36Earlier quoted context omitted.
How many people would fall for it if it first asked for e-mail, said it was safe, and then "test your password too?"
my passwrod, HUNTER2, is surely safe. I checked with some IT friends I met on IRC. Whenever I type my password, HUNTER2 - the rest of the world cant see it. So I am not worried.
Obligatory quote: http://bash.org/?244321
Re: Should I Change My Password?
#37Can't this entire site be replaced with: YES
That's what I half expected the page to be, much like http://hasthelargehadroncolliderdestroyedtheworldyet.com
Re: Should I Change My Password?
#38Can't this entire site be replaced with: YES
In HTML5, both the and tags are completely optional, as are their closing tags. Since there's no other content on this "page", you don't need to close the header either, so you could replace everything with: YES
The title tag is required, though (unless you’re in an iframe), and an h1 tag must be closed (unlike, e.g., paragraph and list item tags). So your minimal page looks like:
YES
YESRe: Should I Change My Password?
#39My first thought was that this would have fields for me to enter my email address and password, under the pretense of "we will test your password to see if it's secure". Wonder how many people you could get with that...
> Wonder how many people you could get with that...
From the lighttpd logs, 842 POST requests for 1834 GET requests from distinct IP adresses (and 1424/5896 overall), but we don't keep logs so I can't know what people submitted, I guess a good part of it is random typing and not really their password.
BTW, the fun is also (if not mainly) in the Terms and Conditions ;-).
Oh, and I host it, but the creator is a3_nm.