4 ms·

If people use the same email and password to log into other services, then those might get compromised also. By now no one "should" be using the same password

If people use the same email and password to log into other services, then those might get compromised also. By now no one "should" be using the same password for multiple services, but it most likely still happens

wing-_-nuts 3y ago
What if I used the 'sign in with google'? Should i be changing my google password?
- TheRealPomax 3y ago
  Unlikely, auth mediation never gives out your password as part of logging into some service, it gets asks to confirm you are logged in and if so, to issue a temporary auth tokens that acts as proof that Google thinks your session is authenticated. So if you explicitly log out, then that token should get invalidated, and logging back in should yield a new auth token.
- moi2388 3y ago
  No. That is simply a token containing some claims sayings you are you, no passwords or anything like that is transferred. Having said that; it is still best practice to set up MFA for all your accounts.
TheRealPomax 3y ago
That's a given. What ramifications are there for this data rather than just the generic "if you're still dumb enough to recycle passwords, you're going to find out why people keep telling you not to". What can the data in these logs actually be used for? Because as far as credential hacks go, 100.000 users is nothing, you can trivially get password lists thousands of times bigger than that on any given day of the week.
pmontra 3y ago
Using the same email is almost certain. I know that we can do at least user+mod@domain, but how many people are actually using that? All the security is in the password. Using a password manager to automatically generate and store password almost fixes that. Then there are services that insist using 8 to 16 character passwords :shrug
- deleted 3y ago
  [deleted]
- bunga-bunga 3y ago
  I've been "hiding my email" with iCloud+ more and more. The drawback is that now I don't know my password and email address for some of my services.

wing-_-nuts 3y ago

What if I used the 'sign in with google'? Should i be changing my google password?

TheRealPomax 3y ago
Unlikely, auth mediation never gives out your password as part of logging into some service, it gets asks to confirm you are logged in and if so, to issue a temporary auth tokens that acts as proof that Google thinks your session is authenticated. So if you explicitly log out, then that token should get invalidated, and logging back in should yield a new auth token.
moi2388 3y ago
No. That is simply a token containing some claims sayings you are you, no passwords or anything like that is transferred. Having said that; it is still best practice to set up MFA for all your accounts.

TheRealPomax 3y ago

That's a given. What ramifications are there for this data rather than just the generic "if you're still dumb enough to recycle passwords, you're going to find out why people keep telling you not to". What can the data in these logs actually be used for? Because as far as credential hacks go, 100.000 users is nothing, you can trivially get password lists thousands of times bigger than that on any given day of the week.

pmontra 3y ago

Using the same email is almost certain. I know that we can do at least user+mod@domain, but how many people are actually using that? All the security is in the password. Using a password manager to automatically generate and store password almost fixes that. Then there are services that insist using 8 to 16 character passwords :shrug

deleted 3y ago
[deleted]
bunga-bunga 3y ago
I've been "hiding my email" with iCloud+ more and more. The drawback is that now I don't know my password and email address for some of my services.