9 ms·
Should I Change My Password?
- hogu 15y agoI was confused be cause I typed "password" into that box and it told me I was safe.
- espo 15y agoThat's because you're supposed to enter an email-address, not a password.
- user9756 15y agoAm I the only one that feels uncomfortable with these kind of sites? Anyway, I tried "abc124" and received: "It looks like your passwords may be safe. No instances of compromise are recorded in this database. However, it's good practice to change your critical passwords regularly and ensure they are not re-used across multiple sites."
- drivebyacct2 15y agoYou're supposed to enter your email address... lol. There's a reason the text box says "Enter email here" and the bottom of the page discussed the "email entered will not be...". Also, it just doesn't make any sense to search by password. Yes, I would be disturbed if a public site was reversing weak poor choices in hash algorithm and publishing data about the resulting passwords.
- user9756 15y agoWell that's embarrassing. Yes, you're quite right, I read everything except that box and I the bottom text (which was just outside of my scroll view). The only defense I can offer is that the name, introduction and the feedback text (which should at least check for "@") is kind off or misleading. Anyway, my fault, I apologize to the web site creator.
- lmz 15y agoHowever, a "should I change my password site" that takes passwords as an input would be pretty simple, just save the entered password and then say "YES".
- jacobr 15y agoHow many people would fall for it if it first asked for e-mail, said it was safe, and then "test your password too?"
- phlux 15y agomy passwrod, HUNTER2, is surely safe. I checked with some IT friends I met on IRC. Whenever I type my password, HUNTER2 - the rest of the world cant see it. So I am not worried.
- emp_ 15y agoObligatory quote: http://bash.org/?244321 http://bash.org/?244321
- dennisgorelik 15y agoHN replaces passwords with stars too. Please try it in your replies.
- dennisgorelik 15y agoDownvoting? Come on - there is always delete button.
- boreacrat 15y agowell, if it was actually safe to do, a password tester would be smart for a lot of people. you might think that the phone number of that cute girl in that movie combined with her initials is a safe password, but if you check out some of the password lists that have popped up the last year you'll see that alot of people thought the same way.
- tseabrooks 15y agoHas anyone published stats on some of the password lists that have been released lately? I'd like to know if they still conform to some of the old 'rules' about common passwords and the like. How many are just words with a single digit at the end, how many include no digits. What percentage are dictionary words? What percentage are leet-speak-ified dictionary words, etc.
- VMG 15y agoThe site should treat @gmail.com and @googlemail.com as equal. I found my leaked MtGox mail address for one variant but not the other.
- ch0wn 15y agousername+randomstring@g[oogle]mail.com should be normalized to username@gmail.com, as well. I used a custom extension for MtGox that wasn't found. That said, really useful service. On the other hand it's sad that we actually need something like this.
- pavel_lishin 15y agoThe other way around, too. If I put in "pavel.lishin@gmail.com", it would be nice if it informed me that "pavel.lishin+iharvestbitcoinsalldumbday@gmail.com" was compromised.
- spoold 15y agoAnd any variation with periods in the username: spoold@gmail.com == s.pool.d@gmail.com == spo.old@googlemail.com
- joeyh 15y agoTechnically, username+randomstring@* should be normalized to username@* ; plus in email address is part of the standard.
- mscarborough 15y agoOr instead of checking by email domains of individual accounts, add an option to search by the domain of the site you are concerned about.
- haentz 15y agoWould be nice to see where the email was leaked from…
- wccrawford 15y agoHere, let me save you some time: If you're asking, then YES. You should change your password. Edit: I get what this is doing, and it's a neat idea... But the answer is still always YES if you ask that question.
- deleted 15y ago[deleted]
- Kwpolska 15y agoUseful, even if I thought I'd see a big-ass "YES" and nothing else.
- JeffL 15y agoPlease tell me I didn't just accidentally give my email to a Spam list.
- a3_nm 15y agoPity that shouldichangemyemail.com doesn't exist yet. :-P
- simonsarris 15y agoI don't know, but you can always try someone else's email if you are curious. For instance, apparently billg@microsoft.com should change his or her password, according to the site.
- argv_empty 15y agoJust in case, I gave it root@localhost
- dagrz 15y agoIt's not a scam of any sort. Happy to discuss with anyone who has concerns.
- bryanalves 15y agoCan't this entire site be replaced with: <html> <body> <h1>YES</h1> </body> </html>
- phlux 15y agoyou forgot your <blink></blink> tags!
- sbierwagen 15y agoIn HTML5, both the <html> and <body> tags are completely optional, as are their closing tags. Since there's no other content on this "page", you don't need to close the header either, so you could replace everything with: <h1>YES
- jacobolus 15y agoThe title tag is required, though (unless you’re in an iframe), and an h1 tag must be closed (unlike, e.g., paragraph and list item tags). So your minimal page looks like: <!DOCTYPE html> <title>YES</title> <h1>YES</h1>
- sbierwagen 15y agoReally? http://validator.w3.org/check?uri=http%3A%2F%2Funitinu.net%2Fyes1.html&charset=%28detect+automatically%29&doctype=HTML5&group=0&user-agent=W3C_Validator%2F1.2 http://validator.w3.org/check?uri=http%3A%2F%2Funitinu.net%2... http://validator.w3.org/check?uri=http%3A%2F%2Funitinu.net%2Fyes2.html&charset=%28detect+automatically%29&doctype=HTML5&group=0&user-agent=W3C_Validator%2F1.2 http://validator.w3.org/check?uri=http%3A%2F%2Funitinu.net%2... http://validator.w3.org/check?uri=http%3A%2F%2Funitinu.net%2Fyes3.html&charset=%28detect+automatically%29&doctype=Inline&group=0&user-agent=W3C_Validator%2F1.2 http://validator.w3.org/check?uri=http%3A%2F%2Funitinu.net%2... Dang, apparently so. Guess I was wrong. The world's most inane objection: If you force the validator to HTML5 mode, (as in the first and second links) then you don't need to declare a DOCTYPE, a savings of 16 bytes. Not that you would ever do that for a real document, since it's a dumb idea.
- Scorponok 15y agoMy first thought was that this would have fields for me to enter my email address and password, under the pretense of "we will test your password to see if it's secure". Wonder how many people you could get with that...
- jerf 15y agoImplemented (not by me): http://estatis.coders.fm/password-security-checker/ http://estatis.coders.fm/password-security-checker/
- p4bl0 15y ago> Wonder how many people you could get with that... From the lighttpd logs, 842 POST requests for 1834 GET requests from distinct IP adresses (and 1424/5896 overall), but we don't keep logs so I can't know what people submitted, I guess a good part of it is random typing and not really their password. BTW, the fun is also (if not mainly) in the Terms and Conditions ;-). Oh, and I host it, but the creator is a3_nm.
- phlux 15y agoso, can someone answer this for me? I have a personal domain on google apps. The login ID is different than the email address I use/advertise. e.g. my username for login is first-initial+last-name@[domain].com But the email address I use for everything on that account is first-name@[domain].com This service states that my account was compromised on 12/12/2010 most recently at the first-name@[domain].com though you could not login to my account with that email address... So - how valid is such a check. Also - without it showing what information it is checking against, it feels really spammy. as if they are asking you to enter your email for a "check" knowing that you will enter a valid email - then they harvest the email as valid for spam.
- joezydeco 15y agoI got the exact same date for my gApps-hosted domain. Odd.
- evan_ 15y agoThat's the date of the Gawker hack.
- joezydeco 15y agoSo any Google-served address is marked as vulerable because of the Gawker hack?
- evan_ 15y agoNo, the google address is a red herring. My non-google account is listed as compromised on the same date due to a Gawker account I had registered. Many google accounts were compromised in other events on other dates.
- joezydeco 15y agoMy mistake. I thought my Gawker account was on another address, but a quick search shows I got the hint.io mail on 12/13.
- knotty66 15y agoFind the MD5 of your password and Google that. Plenty of sites still store an unsalted hash in the database and these are often compromised. If your hash turns up in a rainbow table in Google's index, definitely change it to something more secure (longer, more symbols).
- JoachimSchipper 15y agoI'm not sure that sending the MD5 of your password out over the wide internet is such a great idea. After all, if the bad guys didn't have an easy-to-crack hash of your password yet, you may have just given it to them! (Yes, I know that sniffing such things is not trivial. Still.)
- dennisgorelik 15y agoGoogle publicly shares popular queries in search box. If you are persistent with testing your password hash you risk making that hash public.
- lostbit 15y agoSources are mentioned in the FAQ and top page: https://shouldichangemypassword.com/sources.php https://shouldichangemypassword.com/sources.php It's checking the e-mails on those databases.
- jplewicke 15y agoIt'd be cool if they added an option to subscribe for $10/year for a quick SMS and email notification if your account is compromised. I'd get it for myself and my family.
- josegonzalez 15y ago"Here is the password I use for potentially important information, and here is the email and phone number that would likely be associated with that password. Let me know when your database get's hacked so that way I can change my password and we can do this exercise again." Something like that you mean?
- mjschultz 15y agoYou don't need to give them your password or phone number, just the email address associated with your account(s). Adding a phone number would be optional.
- maratd 15y agoYou don't get it. If your account shows up in their database, then they'll have your email + password + phone number + any other data you provided.
- tlrobinson 15y agoHuh? You don't need to give them anything except for your email address. They only look for your email address in the compromised databases.
- whatusername 15y agoYes you do if you subscribe for notifications.
- tlrobinson 15y ago
- kosei 15y agoPrivacy policy?
- deleted 15y ago[deleted]
- bluehex 15y agoI wish I could query using a hash of my email address. No matter how much their FAQ says they won't use the email for anything but a "single database query" It's hard to trust anyone. Even if this site is legit (I think they probably are) this would be quite the front for a spammer to collect addresses.
- dagrz 15y agoTrust is an issue no doubt and to some extent I wish I had partnered with a big security brand. However, the reality is that you give your email address to various parties all the time, and regardless of how malicious they are, they are rarely secure. Your email is already public, imho.
- viraptor 15y agoStrangely, the exact moment I received the email from mtgox, gmail told me I have to change the password. I wonder if they had a trigger for that message, or did someone really try to access my account (different password, so very unlikely)
- blantonl 15y agoThe Gmail team downloaded the database of mtgox user account information that was leaked, matched gmail addresses to gmail accounts, and then proactively notified those Gmail users to change their passwords.
- invisiblefunnel 15y agoWow I didn't hear about that. Can you provide a source? EDIT: http://news.ycombinator.com/item?id=2672037 http://news.ycombinator.com/item?id=2672037
- viraptor 15y agoNice timing then. I was browsing my gmail and at the same time received mtgox notification on my mobile and got locked out on the browser - assumed the notification email was a trigger.
- encoderer 15y agoI guess extreme caution is good. But saying to somebody Your email, username, and password have been compromised" strikes me as a little sensational. Granted, the average user doesn't need to know or understand the vagaries of password hashes. But if somebody reads this, they should think "OMFG somebody can login to my email account!" I mean, that's exactly what it says. But there's no legitimate reason to believe that. Moreover, if you look at MtGox, Google locked every account on that list and forced people to change their passwords. But if you're Joe User looking at this today, are you going to connect the dots enough to see that yes, you WERE in a data leak, but then you changed your password, but this site just didn't know about it and is informing you only of the leak?
- dagrz 15y agoThere are some leaps that normal users won't make, agreed. It's not an easy problem. Either way I believe that raising awareness in non-techie populations is good. If you have specific suggestions, I would be happy to discuss them.
- mahyarm 15y agoIt would be nice if it also did username+.*@gmail.com searches for us who use the feature to make spam email addresses.
- aw3c2 15y agoTerrible interface. I entered "password" and it told me "It looks like your passwords may be safe. No instances of compromise are recorded in this database. However, it's good practice to change your critical passwords regularly and ensure they are not re-used across multiple sites." Why did I not enter an e-mail address like the light text in the input box says? Well, I let myself mislead by the header image.
- dropshopsa 15y agoI enter "1234" and "123456" Both said my passwords are safe. I think not!
- mostapha 15y agoYou know it clearly says to enter your email address in the input field, right? Of course "password" hasn't shown up in the database…it's not an email address.
- aw3c2 15y agoYes, re-read my last sentence.
- bigfun 15y agoIt's not clear at all. The only information that you should provide your email is that placeholder, which on my monitor is barely visible. The name and information is very misleading. Seriously, i think many people will enter their passwords there (at least those type of people who don't know they shouldn't provide passwords anywhere ).
- dagrz 15y agoIts true, a small number of people enter their passwords. The site has been updated with a quick check to prevent such behaviour. Thanks for the feedback.
- mmaunder 15y agoThanks. I think you just saved me some hassle. Pretty sure it was compromised in the perlmonks hack.
- gst 15y agoIf you share your password across different sites: Yes - you should change it to a non-shared password. There are plenty of password managers that can store randomly generated passwords for you. And if you don't like that there's also PwdHash, although this is less secure as someone might be able to compromise your master password.
- some1else 15y agoIf you ask yourself that question, you should change it.
- tintin 15y agoI entered the e-mail address of my PS3 account. Apparently my password is safe...
- Tyrannosaurs 15y agoBad news for bill gates (billg@...) but good news for Steve Jobs (sjobs@...).
- grimatongueworm 15y agoAs a test, I took one of the email addresses from the list of Arizona law enforcement addresses that lulzsec just released (http://lulzsecurity.com/releases/chinga_la_migra_1.txt http://lulzsecurity.com/releases/chinga_la_migra_1.txt). ShouldIChange site reports no instances of compromised records in it's db.
- grimatongueworm 15y agoEDIT - I just saw the sources page for the ShouldIChange site: https://shouldichangemypassword.com/sources.php https://shouldichangemypassword.com/sources.php
- dagrz 15y agoYeh there way too many lists of 1-5000 email/passwords available on the web. I'm talking thousands if not tens of thousands. It's just too hard to find and add them all. If you find it hard to think about the website as being a comprehensive answer to password problems, think of it as an awareness raiser in the general public. :)
- SocratesV 15y agoSo why should I trust someone who asks me to type my password into a random site? Just because he/she says they will not save it? If you've entered your real password(s) there, you've already failed the test. Also a whois on that domain doesn't even return a person's information, some proxied info only (might be scared of law enforcement since he might have the hacked DB data, but even so, if I didn't trust it, I trust it even less now).
- student154 15y agoThanks for all the feedback guys, your comments are noted. We're working hard on the next iteration of the website as well as trying to ease general concerns about whether we store passwords etc at this point. Please drop twitter: @dagrz a line if you have a direct question or want to keep up with how we're tracking on the project! Thanks for the discussion all!