3 ms·
Blackmail scammers have been using pwned password databases to craft some pretty convincing phishing emails ("I have installed RAT on your system and have been
by agentultra 3y ago
Blackmail scammers have been using pwned password databases to craft some pretty convincing phishing emails ("I have installed RAT on your system and have been watching you through your webcam, proof I hacked you: <old password from pwned passwords> -- send $1800 of BTC to this address and don't go to the police. Maybe use a password manager next time."). Do people get caught in these scams?
I assume most get blocked by spam filters. I've only noticed them when they get past SPI/DKIM filtering and I have to train more. They seem pretty clever.
I appreciate the service and enjoy Troy Hunt's posts. HIBP is great.
- tercmd 3y agoThe Pwned Passwords lookup returns just the number of breaches without any hashes or plaintext passwords. This would not make such an attack possible.
- agentultra 3y agoThat’s good to know. So they’re probably using old dumps.
- _benj 3y agoI mean, I once got an email with my password in plain text and it was pretty disturbing. I did a quick search and realized that that password wasn’t used in anything I cared about so, I just went about my day, still disturbed but knowing that it’s an old password. I can’t imagine how it would feel if I didn’t use a password manager and couldn’t quickly see where was that password used instead of wreaking my brain trying to remember!
- cafard 3y agoCaught, I can't say. I have heard of users becoming alarmed and running to IT for reassurance. I got one or two of these emails, and couldn't for the life of me guess on what sites I had used the (pretty weak) passwords.
- mtmail 3y agoA family member called me in distress asking if the email is legic. It had his full postal address and last 4 digits of a credit card (not an old password). People do believe it.