8 ms·
Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are p
by pvnick 13y ago
Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters.
I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no damage was done and I did a change to the strongest password I've assigned anything yet.
Great job, op (if you're the one who wrote this service) for such an amazing tool. Everyone, if you haven't already, you really should check if you've been compromised. I will be sending this to all my friends.
- redidas 13y agoI woke up this Thanksgiving with a bunch of email notifications from Paypal that my account had been hacked and taken over. I (also shame on me) tend to reuse some of my passwords, and figured someone got into my Paypal account using my adobe credentials, not even being sure if I had created an account with adobe for anything in the past. I checked my email address on this site and it didn't find any pwnage. I'm relieved my email address isn't in any of these leaks, but also now concerned about whatever it was that let someone into my paypal account so easily...
- mcv 13y agoIf you reuse passwords, separate throw-away accounts (like Adobe or pretty much anything that's not your email, your bank or PayPal), from the important stuff. Sites that need to be secure, hopefully really are secure. Sites that don't really need to be secure because they don't deal in anything of value, probably don't invest quite as much in security. Reusing passwords across those different kinds of sites means the extra security of the secure sites is wasted. Of course it's way better not to reuse at all, but remembering two or three passwords is a lot easier than dozens, and still a lot safer than just one.
- da_n 13y agoThis should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.
- elwell 13y agoWhat do you do when you are using a different computer and need to login to site?
- BlackDeath3 13y agoIf you don't mind paying a small annual fee, Lastpass is a very nice tool for automated password management across devices.
- zenojevski 13y agoPresumably you can open your password manager's web service and do it from there.
- baddox 13y agoThat or use your phone. Most password managers have apps.
- elwell 13y agoOk, that makes the most sense to me.
- mcv 13y agoI wouldn't want to use a webservice to look at my passwords. I want to open my password safe locally. Less likely to be snooped upon (though still possible, obviously).
- Habesha 13y agoYou can have the password repository in dropbox to sync between different machines, and also use the app
- alexgaribay 13y agoAfter the Macrumors breach (I had only signed up about 2 weeks before it happened), I decided it was time to make all my passwords unique and to use a credentials manager like 1Password. I too shared the same password for multiple sites/services (shame on me too).
- orn 13y agoMy wife was on the Adobe list, the same credit card she used at Adobe was charged from Amazon or paypal ( I can't remember which ) couple of weeks after the leak. She called the bank they closed it right away and took the charges off the card.
- Keyframe 13y agoLooks like I was caught in Adobe breach as well. Luckily I use one off passwords for each site I log into. Damn.
- TrainedMonkey 13y agoI got pwned by adobe too. Luckily password there was one of my "weak" ones, and I do not use it anywhere of importance.
- sejje 13y agoThat's not very "lucky," it seems very intentional.
- TrainedMonkey 13y agoIt was lucky in a sense that if adobe required complex passwords more important password would have been leaked. It was also lucky in a sense that adobe itself got hacked instead of entity that has one of my more sophisticated and thus valuable passwords.
- finnw 13y agoI had a very insecure password on adobe.com. i.e. low-enough entropy that 55 users had the exact same password. I figured since Adobe do not have my credit card number and there is nothing to gain by impersonating me on that site, it did not matter. I have not used the same email/password combination elsewhere, but even if I did it would only be on other low-value accounts. I'm not worried about attackers finding it by association either (they will have it already from dictionary attacks.)
- dephex 13y agoI had something similar happen to one of my Windows Live accounts. Someone somehow broke into it and, although I did not have any credit card information, they decided to continue to use it. They added a stolen credit card to the account. I received an email in japanese from Xbox Live (! I have never owned an Xbox, someone converted my account, nor do I speak japanese) at one point which prompted me to call their support and figure all of this out. But the point I'm trying to get across is, if I were unlucky that could have turned into a HUGE mess where I was accused of stealing said credit card. Luckily that did not occur (probably because they could trace it to a separate IP address.. and I don't own an Xbox). I no longer use passwords as insecure as I did for that account - I had to deal with this headache while at my family's Christmas party as well (because that is when I received the email), which made it even more irritating.
- graeme 13y agoAnyone know what adobe's password requirements were? I don't know which password I used there: Adobe forced me to change it without letting me test the old one.
- aimhb 13y agoYou can just torrent users.tar.gz (the leaked list of encrypted passwords) and then grep the file for your email address, which will give you the encrypted version of your password.
- _xo_ 13y ago...which does not really help without the crypto-key - even if you know a list of possible passwords you cannot test them.
- jychang 13y agoWell, funnily enough, if you know your password and it was in the leak, you can test it against your own password.
- bitJericho 13y agolastpass.com/adobe will show you the list of hints of yourself and other users that used the password.
- loceng 13y agoWonderful. sarcasm
- esurc 13y agoFor the Adobe breach specifically, you might try the site set up by Last Pass, which checks your email against the breached data: https://lastpass.com/adobe/ https://lastpass.com/adobe/ The added feature is that, if your email is in the list, Last Pass will share with you how many others had your same password -- and the list of all password hints associated with that password. If more than a handful of others used the same password, that should jog your memory about which you used. P.S. I'm not associated with Last Pass and actually use a different product. But I found this site very helpful.
- mcv 13y agoOne of my addresses was also in the Adobe breach. No idea what password I used there, but I'm fairly sure it must have been either my common "junk" password, shared with tons of forums, but nothing that poses any serious risk to me (just to those forums). Or if they had stricter requirements, some variation on it that I always forget, so I have to ask them for a new password every time anyway. I certainly don't reuse financial or email passwords. Or actually I do, but only for financial and email stuff. But I probably shouldn't reuse them at all. But those forums? I'm just not going to keep track of a new password for every site I visit.
- bigiain 13y agoIf you're using a forum, outré in front of a computer. Keeping track of things is one of the things computers are _best_ at. Get yourself a password manager. I use 1Password, but I hear good things about KeyPass and LastPass too. Seriously - you can't manage 2013 grade password complexity requirements for all the places you need passwords in your head any more (it's likely you never could…) Get a tool to help, computers are wonderful tools.
- mcv 13y agoI've got KeePass, but I haven't used it remotely as long as I've used many websites. Also, I don't have my KeePass DB in Dropbox, so I can't access it from other computers. More than that, I'd rather not put my KeePass DB on someone else's machine in the first place. But I'll easily trust strange computers with a password for some crappy forum. There's always something you risk compromising. I prefer some forum account to be compromised.
- scoggs 13y agoMine showed for Adobe as well, but I don't have an account with Adobe?
- walden42 13y agoYahoo here. How the hell did the hackers get the passwords in plain text? Were they seriously unencrypted?
- thrill 13y agoThey were encrypted, but with no variation between the hashes for per email. https://lastpass.com/adobe/ https://lastpass.com/adobe/ will show you the password hints associated with the (in my case) 200 people with the same (hashed) password. The clues would be sufficient to guess the password. I've gone to generating a unique password with a simple random number generator if the end site supports password recovery (in case Chrome's password memorizing system forgets it). #!/bin/bash if [ $1 ] ; then a=$1 else a=16 fi dd if=/dev/urandom bs=1000 count=1 2>/dev/null | tr -d -c "[:alnum:]" | tr -d '`' | tr -d "'" | tr -d '"' | tr -d '\\' | head -c $a echo
- rmk2 13y agoThis is not meant as criticism: Is there any particular reason for all the tr pipes? Is there any advantage to using tr instead of base64? I essentially use the following: base64 </dev/urandom | head -c $COUNT | xargs -0
- andrewaylett 13y agoI much prefer using the program `pwgen`. It's installed on all my Linux boxes and it's available from Cygwin too, and it generates a 'pronounceable' password, which makes it a lot easier to remember and also much easier to copy. There's also the benefit of fewer moving parts -- with a pipeline like that, I'd be worried about accidentally stripping out some of the randomness. I'm fairly confident that a simple invocation of `pwgen` will work.
- loceng 13y agoFuck me. Ditto. The reason I checked? I unknowingly, until today, had a domain name transferred away from me -- or rather, ownership changed, for a domain I bought years ago for $3,000. Email address used for that domain in Adobe breach.
- pawelk 13y ago> Looks like I got caught up in the adobe breach. I knew I was, but I was delighted by what Dreamhost did: they have cross-checked their users' e-mails with the Adobe leaked database and sent a message [1] to affected users explaining the situation and advising to change the passowrd, reminding to not re-use passwords and suggesting password vaults. I think it's a great thing to do by third-parties when leaks of this magnitude happen. [1] Full text: http://pastebin.com/2AkU0v98 http://pastebin.com/2AkU0v98
- mattholtom 13y agoHave fun closing your account by the way, I went through that fiasco recently. I regularly run the LastPass security challenge and an old email of mine was in the Adobe breach too. 49 customers are in line ahead of you. ..5 mins.. 48 customers are in line ahead of you. ..5 mins.. 48 customers are in line ahead of you. ..5 mins.. 48 customers are in line ahead of you. ARG!
- SideburnsOfDoom 13y ago> Great job, op (if you're the one who wrote this service) Looks like no. "Have I been pwned?" is by Troy Hunt http://www.troyhunt.com/ http://www.troyhunt.com/ The OP's bio indicates that they are someone else. https://news.ycombinator.com/user?id=mountaineer https://news.ycombinator.com/user?id=mountaineer