4 ms·

or how about just don't re-use passwords accross accounts. If they had used a unique password they would've been fine right? I don't understand what users wan

or how about just don't re-use passwords accross accounts. If they had used a unique password they would've been fine right? I don't understand what users want google to do: it's the house equivalent of taking your key and leaving it at the grocery store.

rvnx 7y ago
It's not so sure, in some cases, passwords can be compromised by other ways directly from the source, or accesses can be derived from misimplemented APIs. No matter how big the company is, this is really realistic. Facebook, Google and others all used to leave some passwords in clear-text during very long time for anyone to check in the logs. Google even got their central password system compromised and source-code stolen (Gaia). It can also be a password recovery process that can have glitches (Steam), or just not checking password properly due to deployment errors (Dropbox) or just compromised servers (my unique EA Origin password was compromised like this, my LinkedIn password as well, my Twitter password...) etc many possibilities
- freeflight 7y ago
  At this point, I just assume that any password I have somewhere is public in some way, if something doesn't have 2FA, it might as well be compromised. Case in point: I just checked an e-mail account I haven't used in close to 20 years, even that thing has now a somewhat lengthy haveibeenpwned profile.
- rvnx 7y ago
  Sources: Google Gaia: https://www.itnews.com.au/news/insider-reveals-details-of-google-hacks-172661 https://www.itnews.com.au/news/insider-reveals-details-of-go... LinkedIn: https://en.wikipedia.org/wiki/2012_LinkedIn_hack https://en.wikipedia.org/wiki/2012_LinkedIn_hack Facebook: https://www.theguardian.com/technology/2018/sep/28/facebook-50-million-user-accounts-security-berach https://www.theguardian.com/technology/2018/sep/28/facebook-... (fun fact, it happened TWICE) Dropbox: https://www.troyhunt.com/the-dropbox-hack-is-real/ https://www.troyhunt.com/the-dropbox-hack-is-real/ Another Dropbox: https://techcrunch.com/2011/06/20/dropbox-security-bug-made-passwords-optional-for-four-hours/ https://techcrunch.com/2011/06/20/dropbox-security-bug-made-...
- thorwasdfasdf 7y ago
  Well, in that case, as a long term solution, we need to start teaching basic tech security in k-12, kinda like we teach kids drivers ed, home economics, shop class, etc. It doesn't have to be a whole class. Maybe just 1 or 2 hours per year, go through all the basics of security like how to 2FA, and how to pick unique passwords. Or use some kind of hashing strategy that's based on remembering a single password. It would use your psssword plus the login website name to generate a unique password.

rvnx 7y ago

It's not so sure, in some cases, passwords can be compromised by other ways directly from the source, or accesses can be derived from misimplemented APIs. No matter how big the company is, this is really realistic. Facebook, Google and others all used to leave some passwords in clear-text during very long time for anyone to check in the logs. Google even got their central password system compromised and source-code stolen (Gaia). It can also be a password recovery process that can have glitches (Steam), or just not checking password properly due to deployment errors (Dropbox) or just compromised servers (my unique EA Origin password was compromised like this, my LinkedIn password as well, my Twitter password...) etc many possibilities

freeflight 7y ago
At this point, I just assume that any password I have somewhere is public in some way, if something doesn't have 2FA, it might as well be compromised. Case in point: I just checked an e-mail account I haven't used in close to 20 years, even that thing has now a somewhat lengthy haveibeenpwned profile.
rvnx 7y ago
Sources: Google Gaia: https://www.itnews.com.au/news/insider-reveals-details-of-google-hacks-172661 https://www.itnews.com.au/news/insider-reveals-details-of-go... LinkedIn: https://en.wikipedia.org/wiki/2012_LinkedIn_hack https://en.wikipedia.org/wiki/2012_LinkedIn_hack Facebook: https://www.theguardian.com/technology/2018/sep/28/facebook-50-million-user-accounts-security-berach https://www.theguardian.com/technology/2018/sep/28/facebook-... (fun fact, it happened TWICE) Dropbox: https://www.troyhunt.com/the-dropbox-hack-is-real/ https://www.troyhunt.com/the-dropbox-hack-is-real/ Another Dropbox: https://techcrunch.com/2011/06/20/dropbox-security-bug-made-passwords-optional-for-four-hours/ https://techcrunch.com/2011/06/20/dropbox-security-bug-made-...
thorwasdfasdf 7y ago
Well, in that case, as a long term solution, we need to start teaching basic tech security in k-12, kinda like we teach kids drivers ed, home economics, shop class, etc. It doesn't have to be a whole class. Maybe just 1 or 2 hours per year, go through all the basics of security like how to 2FA, and how to pick unique passwords. Or use some kind of hashing strategy that's based on remembering a single password. It would use your psssword plus the login website name to generate a unique password.