4 ms·
It would be nice if they forced a password reset for all affected users and submitted the old passwords to the Pwned Passwords list. I have trouble believing n
by Rjevski 8y ago
It would be nice if they forced a password reset for all affected users and submitted the old passwords to the Pwned Passwords list.
I have trouble believing no passwords have been misused by insiders - sure, there wasn't any large-scale misuse but I am sure someone poaching a few passwords here and there for later mischief (once everything has settled down) would have gone unnoticed.
- ghazak 8y agoAgreed. I am assuming they will not do it for the same reason yahoo didn’t. They are simply afraid of losing too many active users. Yahoo’s case was worse though, since it was hacked.
- Rjevski 8y agoIf the previous breaches are of any indication, it's that users don't give a shit - many major websites have leaked passwords (https://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites) and they're still alive and kicking; for the ones that have gone down the drain (Yahoo!) it was more because the service itself faded into irrelevance. Based on that I'd say it would be pretty safe to disclose a breach and reset all passwords; if your service is relevant your users will stay with you, and if not then not disclosing a breach will only buy you time before the inevitable happens anyway.
- scrollaway 8y agoI suspect by "Losing active users", GP meant losing people who get confused or stuck throughout the password reset phase. Twitter is used by a lot of computer novices. Twitter did disclose this, through email and on first login. Anyone they'd lose because of the breach is long gone and I also think it's probably next to nobody.
- ghazak 8y agoYes, I’m purely talking about losing people if they forced a password reset.