21–30 of 65 posts
2FA makes this a non-issue, no? You will get notificaton if someone failed to log in.
Not even necessary. Salted hashes are enough, assuming you used a strong password.
Unless they were storing them all unencrypted lol.
Earlier quoted context omitted.
As if users wouldn't just use the same username everywhere. So now besides telling them to use different passwords for every website, you also need to tell them to use different usernames.
But you can't use the same username everywhere, for example doing a Google search of my username shows accounts on other sites that are not related to me. Doing a search for your username suggests that it is also likely taken on numerous other sites, including a rock-band named FoxyGen that I'm fairly confident you are not a member of.
> According to a report published this week, Cybernews researchers have recently discovered 30 exposed datasets that each contain a vast amount of login information — amounting to a total of 16 billion compromised credentials. That includes user passwords for a range of popular platforms including Google, Facebook and Apple. Can someone more knowledgeable than me explain how my passwords could have been leaked from G…
“There was no centralized data breach at any of these companies,” Diachenko said when I asked him to clarify whether any of the datasets actually came from Facebook, Google, or Apple.
Bob Diachenko, a Cybernews contributor, cybersecurity researcher, and owner of SecurityDiscovery.com, is behind this recent major discovery.
https://cybernews.com/security/billions-credentials-exposed-...
Will this make its way to haveibeenpwned or other services?
> According to a report published this week, Cybernews researchers have recently discovered 30 exposed datasets that each contain a vast amount of login information — amounting to a total of 16 billion compromised credentials. That includes user passwords for a range of popular platforms including Google, Facebook and Apple. Can someone more knowledgeable than me explain how my passwords could have been leaked from G…
Keyloggers, people reusing passwords
On the 16 billion logins scale, it's just this.
> Sixteen billion is roughly double the amount of people on Earth today, signaling that impacted consumers may have had credentials for more than one account leaked Interesting use as "may have" as that would imply, mathematically speaking, that there are people who were impacted at least twice...
The list might also span a large time period and contain multiple versions of a user's credentials.
> According to a report published this week, Cybernews researchers have recently discovered 30 exposed datasets that each contain a vast amount of login information — amounting to a total of 16 billion compromised credentials. That includes user passwords for a range of popular platforms including Google, Facebook and Apple. Can someone more knowledgeable than me explain how my passwords could have been leaked from G…
Keyloggers, people reusing passwords
the article mentioned passkeys as a solution but imho is only a path towards vendor lock-in. Like, "we solve your security issue provided you do business only with us". That is neither "antifragile" nor resilient. It's just hype.
I have my passkeys in 1password and they work fine. One key for each service, I don't see the difference to normal passwords in terms of lock-in
How does storing passkeys in a password manager materially differ from the very long/strong passwords I'm already storing in my password manager? (and it's matching against the domain around autofill etc)
2FA makes this a non-issue, no? You will get notificaton if someone failed to log in.
Not even necessary. Salted hashes are enough, assuming you used a strong password.