|
Hi,
I actually think it may be a good samaritan informing you that you need to change your password. Many of the databases containing your password are available for anyone (including you) to download. They are in the public domain... you just need to know where to look.
But don't worry... Microsoft Regional Director Troy Hunt has already downloaded all of those hacked databases for you. He's managed to collect over 7 Billion hacked accounts from all over the world.
You can easily check to see if any of your e-mail addresses have been compromised by visiting his website and entering your e-mail.
Have I Been Pwned?
Best Wishes,
-David Delaune
P.S.
He is actually looking for someone to buy the website. So if you know anyone... contact him.
|
|
|
|
|
Thanks, I know all that......
It was more the fact;
1) that I had only got these emails recently, never before
and
2) curios as to which site it was
just like many of us I am sure, in the early days the same password was used everywhere for all non critical sites and forums, so it could be from anywhere. I couldn't even begin to think what some of the sites I might have been registered on all those years ago....
|
|
|
|
|
DaveAuld wrote: 2) curios as to which site it was
If you visit the site I gave you... the accounts are listed at the bottom after you enter your e-mail address. Just scroll down to the bottom.
Best Wishes,
-David Delaune
|
|
|
|
|
As the link I provided states, "someone" had 12.000 files of passwords and leaked them recently.
Imagine the banks leaking your PIN, and not be accountable 
Bastard Programmer from Hell 
If you can't read my code, try converting it here[^]
"If you just follow the bacon Eddy, wherever it leads you, then you won't have to think about politics." -- Some Bell.
|
|
|
|
|
Randor wrote: Microsoft Regional Director Troy Hunt
iS HE ANY RELATION TO mIKE hUNT OR YuRK hUNT?
CQ de W5ALT
Walt Fair, Jr., P. E.
Comport Computing
Specializing in Technical Engineering Software
|
|
|
|
|
That's spam, my quarantine box is chock full of them. Don't reply, fret or otherwise feed the beast at all. 
|
|
|
|
|
DaveAuld wrote: am just intrigued at which site must have been hacked, but guess I will never know.
You could reply back with the correct password, so they can at least pass out good information.
CQ de W5ALT
Walt Fair, Jr., P. E.
Comport Computing
Specializing in Technical Engineering Software
|
|
|
|
|
I had to calm down a panicked friend who received an email with the password of his internet bank account. He had changed it some time ago (he couldn't tell exactly when; he had actually changed it a couple times since the leaked one), but was scared that the sender might have his current password as well.
First: All banks in Norway use two-factor authenticaton. In addition to the password, you must specify a six-digit one-time pin code generated by a code chip (or your smartphone). The password alone gets you nowhere.
Second: But the password was leaked... Sure, but when did you first use that password? In 2004 you say?? At that time, "noone" was using HTTPS, not even the banks. Anyone who handled the IP packets along the path between your PC and the bank, any man-in-the-middle, could have picked up the password. Banks introduced HTTPS many years ago. If the password was a recent one, introduced after the switch to HTTPS, I would have been worried. Any "leaked" password from pre-HTTPS days should not worry anyone, as long as you have changed your password since HTTPS came in place.
I succeeded in calming down my friend 
|
|
|
|
|
Member 7989122 wrote: Second: But the password was leaked... Sure, but when did you first use that password? In 2004 you say?? At that time, "noone" was using HTTPS, not even the banks. Anyone who handled the IP packets along the path between your PC and the bank, any man-in-the-middle, could have picked up the password. Banks introduced HTTPS many years ago. If the password was a recent one, introduced after the switch to HTTPS, I would have been worried. Any "leaked" password from pre-HTTPS days should not worry anyone, as long as you have changed your password since HTTPS came in place.
How many IP-packets would you think you handled?
Most of these passwords come not from hacks, but simply leaks. And yes, we already knew about hashing and salt. Too many sites that stored passwords in plain text, and for too long there were no consequences when doing so, only associated costs without a return-on-investment.
Bastard Programmer from Hell 
If you can't read my code, try converting it here[^]
"If you just follow the bacon Eddy, wherever it leads you, then you won't have to think about politics." -- Some Bell.
|
|
|
|
|
Too many sites that stored passwords in plain text - there is no doubt about that.
Yet, I haven't yet heard about any significant passwork leaks from established banks in this country. They have been security aware since the days when coins were real silver. They were the very first to make two-factor authentication standard: Before the electronic PIN chips became available, they used code charts sent to you as registred mail. That must have been in the early 1990. The PIN chips came in the mid 1990s, long before anyone else was using it. And they used HTTPS many years before we began demanding everybody over to HTTPS.
I am more surprised that someone has eavesdropped on the line many years ago, and then comes today threatening to reveal intimate photos of you unless you transfer a number of BitCoins to him before a given date. This eavesdropper must be assuming that most people never change their password, so that what was leaked five or ten years ago is still the valid one. And he assumes that none of these bank customers understand that the password alone can do nothing harm. Maybe the customers really are that naive! After having ridiculed "Nigeria scam" for ten years or more, there were still lots of people believing in it.
|
|
|
|
|
I have a hard time believing this is from eavesdropping. The largest amount will be from leaked databases - something which is quite often in the news, even with bigger companies.
Member 7989122 wrote: I am more surprised that someone has eavesdropped on the line many years ago, and then comes today threatening to reveal intimate photos of you unless you transfer a number of BitCoins to him before a given date.
I'm not, since that too, according to the link, not due to someone gathering passwords by eavesdropping. Someone leaked a LOT of databases with passwords in one go, making them available for anyone with malicious intent.
People would have lost faith in the bank if they were to leak their databases, giving them an incentive to work on security. Twatter et all did not have that problem, and lacked the incentive. This is merely the result of that.
Bastard Programmer from Hell
If you can't read my code, try converting it here[^]
"If you just follow the bacon Eddy, wherever it leads you, then you won't have to think about politics." -- Some Bell.
|
|
|
|
|
Yes, at least until our filter had been tweaked... I even posted about it...
"The only place where Success comes before Work is in the dictionary." Vidal Sassoon, 1928 - 2012
|
|
|
|
|
Yep, my email claimed a video of me whacking off to porn would be sent to all my contacts unless I paid money.
|
|
|
|
|
I got the same - an email claimed a video of you whacking off to porn. Of course I paid !
|
|
|
|
|
|
I paid so that they do NOT send the video. A few bitcoins, so I won't get my pool this year
|
|
|
|
|
Damn that Ashley Madison.
|
|
|
|
|
Quote: I am just intrigued at which site must have been hacked, but guess I will never know.
You could go through this list, Have I Been Pwned: Pwned websites[^] - Warning for the faint of heart really scary how many sites have been breached.
|
|
|
|
|
Abbas A. Ali wrote: really scary how many sites have been breached
Or, for those who've spent any time in QA, really surprising how few sites have been breached. 
"These people looked deep within my soul and assigned me a number based on the order in which I joined."
- Homer
|
|
|
|
|
Richard Deeming wrote: really surprising how few sites have been breached
Or maybe only a handful sites have known to be breached.
|
|
|
|
|
DaveAuld wrote: I am just intrigued at which site must have been hacked, but guess I will never know.
You should ask which ones have NOT been pwned instead, the list is probably shorter.
M.D.V. 
If something has a solution... Why do we have to worry about?. If it has no solution... For what reason do we have to worry about?
Help me to understand what I'm saying, and I'll explain it better to you
Rating helpful answers is nice, but saying thanks can be even nicer.
|
|
|
|
|
When I sign up to a site that requires a password, I generally use a unique email address. (I own my domain name so can have unlimited email addresses; there's a catch-all that routes non-existent addresses to my "real" mailbox, but retains the original "to" address. This way if I get spam addressed to "codeproject@[mydomain]" I can be pretty certain that it was CP that leaked my details / sold my address (for instance).
The only pain is if, when contacting them for any reason, they insist on having a sending address that matches what you signed up with. But they're few and far between.
|
|
|
|
|
How many of our friends in England are aware of the American baseball games that are going to happen this weekend in London?
The New York Yankees are going to play the Boston Red Sox. Baseball is a big hit in America, Latin America, Japan and southeast Asia. Now they want to introduce it to Europe!
Do you know anyone who is going?
The difficult we do right away...
...the impossible takes slightly longer.
|
|
|
|
|
Dear Metropolitan Police. Please arrest all the New York Yankees...
|
|
|
|
|
You must be a Boston fan!
The difficult we do right away...
...the impossible takes slightly longer.
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
