4 ms·

So why are they not invalidating exposed passwords like Github did the other day? At the very least they should have a security alert at the top of your feed o

So why are they not invalidating exposed passwords like Github did the other day? At the very least they should have a security alert at the top of your feed or something. Edit: Looks like they are alerting users.

uptown 9y ago
Because it'd destroy their MAU numbers.
lucb1e 9y ago
Github didn't invalidate passwords. They sent an email to affected users (or just everyone?) with a generic password reset link (https://news.ycombinator.com/item?id=16972050 https://news.ycombinator.com/item?id=16972050 )
- dawnerd 9y ago
  I got forced logged and and required a password reset. That was an invalidation.
  - lucb1e 9y ago
    Oh, then we must have gotten different emails (the one I got was in the linked thread). I didn't know some people got something else!
    - dawnerd 9y ago
      Same email I got. Strange if not everyone was logged out.
- stordoff 9y ago
  I got the same email, and had my password invalidated (trying to log in just gives "Incorrect username or password"). To add to the speculation in the linked thread, I _did_ recently reset my password, but it was on 28th February.
- isostatic 9y ago
  I haven't received anything from github, but I use two-factor and oauth tokens, and I don't remember the last time I logged in, let alone changed my password.