Use the “passwords” feature to check if one of yours is compromised. If it shows up, never ever reuse those credentials. They’ll be baked into thousands of botnets etc. and be forevermore part of automated break-in attempts until one randomly succeeds.
You must log in or # to comment.
Apparently my email was included in this breach, but my none of the passwords I used with it (before I started using randomly generated ones).
For me, if this happens, it has no impact since almost every page i sign up to has a unique password. The most important ones has mfa as well.
Use a password manager. Simple.
Same, but I do have some level of worry regarding portability. My solution isn’t local or self hosted, as I was looking for easy and works across Linux/Windows/Mac/Android/iOS. I do not look forward to needing to change to a new password manager in the future, but given the way everything seems to be going it seems likely that I’ll have to at some point.
Right answer. In fact, the only viable answer.
I think its almost a crime that browsers havent evolved to make users generate unique, secure passwords by default. Its just another huge sign that these browser companies dont care about security or privacy, despite their marketing departement rabbling those words.
I dont think there has been any evolution at all in this area. Browsers can save passwords but they dont help the user generate secure, unique ones, and dont encourage users to have separate accounts. Instead the web is trying to make users use something like Google or Facebook logins, so they are completely dependent on those tech companies.
Firefox generates random passwords for you by default. You have to disable it in the settings if you want to use another password manager besides Firefox’s built in one.
You can right click any password field in Chrome and the first option is “generate random password”.
2 Issues are the they (1) it is unreadable by humans instead of being a passphrase, and (2) The generator does not read any rules off the page so you might have to add a special character.
But the functionality has existed for over a decade
@Rooster326 @1984 it also asks if you would like to generate a secure password, rather than it just being on right-click, in most “new password” fields.
Google password manager also warns you if you have duplicated passwords saved in it and prompts you to create new, unique ones.
I don’t like Google but they do ok with password management I think.
Comprised of email addresses and passwords from previous data breaches,
So these are previously “hacked” data, and now the aggregator has been hacked?
As someone who consults in the IT Security space, It’s bad out there. Contractors and BYOD companies are downright sheepish in asking their outsourced employees to do anything security-related to their devices. The biggest attack vector is allowed unfettered remote access (and therefore the whole company and any bad actors are also granted unfettered remote access)
I still can’t get over how quickly companies-at-large have abandoned VPN Servers (removing network trust from the list of options as well)
I’m down to managed browsers via IdP, and I just can’t wait for the objections to that as well. People out here offering their faces to leopards. Certificate-based MFA on all the things IMO - passwords shouldnt matter (but six digit MFA codes aren’t immune to fake landing pages and siphoned MFA tokens that don’t expire)
Let’s make a master list of all the emails leaked with their passwords, what could go wrong?
That’s not how it works
It’s exactly how it worked. A company called synthient made a master list with all the leaked emails + all leaked passwords. Then they were hacked and it leaked
Synthient wasn’t hacked, as a security company, they aggregated tons of stealer logs dumped to social media, Telegram, etc.
They found 8% of the data collected was not in the HIBP database, confirmed with some of the legitimate owners that the data was real.
They then took that research and shared it with HIBP which is the correct thing to do.
I was also thrown off by the title they gave it when I first saw it, a security company being hacked would be a terrible look. but they explain it in the article. Should probably have named it “list aggregation” or something.
so why hibp calls them data breach??? Ultra misleading, almost defamation, everyone including me only reads the headlines
Someone should make a list of all the leaked credentials that got leaked.
But then nothing has changed if they were just collating what was already leaked.
Protip for the room: Use a password manager with a unique password for every service. Then when one leaks, it only affects that singular service, not large swaths of your digital life.
I was thinking about this earlier. The password manager browser plugin I use (Proton Pass) defaults to staying unlocked for the entire browser session. If someone physically gained access to my PC while my password manager was unlocked, they’d be able to access absolutely every password I have. I changed the behavior to auto-lock and ask for a 6-digit PIN, but I’m guessing it wouldn’t take an impractical amount of time to brute-force a 6-digit PIN.
Before I started use a password manager, I’d use maybe 3-4 passwords for different “risks,” (bank, email, shopping, stupid shit that made me sign up, etc). Not really sure if a password manager is better (guess it depends on the “threat” you’re worried about).
Edit: Also on my phone, it just unlocks with a fingerprint, and I think law enforcement are allowed to force you to biometrically unlock stuff (or can unlock with fingerprints they have on file).
If someone can gain physical access to your PC you are done anyway, he van simply copy the file or do whatwver he want
Yes, it is better. The likelihood that someone will physically access your device is incredibly low, the likelihood that one of the services in your bucket gets leaked and jeopardizes your other accounts is way higher.
I set mine to require my password after a period of time on certain devices (the ones I’m likely to lose), and all of them require it when restarting the browser.
it just unlocks with a fingerprint, and I think law enforcement are allowed to force you to biometrically unlock stuff
True, but it’s also highly unlikely that LE will steal your passwords.
My phone requires a PIN after X hours or after a few failed fingerprint attempts, and it’s easy to fail without being sus. In my country, I cannot be forced to reveal a PIN. If I travel to a sketchy country or something, i switch it to a password unlock.
I use a “password pattern”, rather than remembering all the passwords, I just remember a rule I have for how passwords are done, there are some numbers and letters that change depending on what the service is so every password is unique and I can easily remember all of them as long as I remember the rules I put in place
So when someone figures out your rule he has all the passwords
That is assuming that someone will sit there and try to decrypt password rules for that specific person. Chances of that happening are basically 0, unless they are some sort of a high interest person.
If there’s a leak with multiple services, it’s possible some script kiddie will flag it as having a pattern. I’m guessing the rule is simple enough that an unsophisticated attacker could figure it out with several examples.
It’s way better than reusing passwords, but I don’t think it’s better than a password manager, and it takes way more effort esp given all the various password rules companies have (no special characters, must have special character, special character must be one of…). If you’re paranoid, use something like keypassxc that’s just a file.
-
figure out the rule
-
figure out the services
-
figure out the usernames
-
What’s more likely, a password manager gets a breach or someone targets only me and manages to find out multiple passwords across multiple services and cross compares them works out what the random numbers and letters mean…
I don’t know your rule, but when I hear this, usually it includes the name of the service or something, so a script kiddie armed with a levenstein distance algo could probably detect it.
That said, the “safer than the person next to you” rule applies here. You’re probably far enough down that list to not matter.
As for password manager breaches, the impact really depends on what data the password manager stores. If all decryption is done client-side and the server never gets the password, an attacker would need to break your password regardless. That’s how Bitwarden works, so the only things a breach could reveal are my email, encrypted data, and any extra info I provided, like payment info. The most likely attack would need to compromise one of the clients. That’s possible, but requires a bit more effort than a database dump.
No you are right, your method is stronger than using a password manager hahaha of course there will never be a targeted attack or anything like it
Also, length is most of what matters. A full length sentence in lowercase with easy to type finger/key flow for pw manager master, and don’t know a single other password. Can someone correct me if I’m wrong?
As always, the most secure password is the least convenient and accessible. It’s a trade off, but you want fewer dictionary words and patterns overall. Preferably with a physical component for the master password.
Longer is better…giggitty.
You are mostly correct it is length * (possible char values).
See passphrase generator.
https://www.keepersecurity.com/features/passphrase-generator
You are mostly correct it’s (possible char values) ^ length.
I’ve found that there are a handful of passwords that you need to remember, the rest can go in the password manager. This includes the password for the password manager, of course, but also passwords for your computer/phone (since you need to log in before you can access the password manager), and your email (to be able to recover your password for the password manager).
You are also correct that length is mostly what matters, but also throwing in a random capitalization, a number or two, and some special character will greatly increase the required search space. Also using uncommon words, or words in other languages than english can also greatly increase the resistance to dictionary attacks.
your email (to be able to recover your password for the password manager)
If your password manager has a password recovery mechanism, that means your key is stored on the server and would be compromised in a breach. If that’s the case, I highly recommend changing password managers.
The ideal way a password manager works is by having all encryption done client-side and never sending the password to the server. If the server cannot decrypt your password data, neither can an attacker. That’s how my password manager works (Bitwarden), and I highly recommend restricting your options only to password managers with that property.
If you need a backup, write it in a notebook and keep it in a safe. If your house gets broken into, change your password immediately before the thief has a chance to rifle through the stuff they stole. My SO and I have shared passwords to all important credentials, so that’s out backup mechanism.
throwing in a special character
Okay, but hackers don’t have to know whether I used special character or just lowercase? Or am I stoopid?
And an email alias.
I hate how many places don’t allow for + aliases. I want to know who leaked my email.
+aliases are convenience aliases only. They are often stripped from ID datasets. Better to use a real alias.At the same time, it is trivially easy to strip a + alias, so I’d not trust it to do anything much at all.
If you use aliases for all services, it makes it slightly harder to automate trying one leaked email on another site, since the hacker needs to add the new alias on the other service.
No one is going through of all these credentials manually, so any extra obscurity can actually bring you security in a pinch. Although if you have different passwords this shouldn’t matter much…
No, you just run a simple Regex on both combolists and are done. It literally takes seconds
No + required. There are hundreds of companies offering aliases using their shared domain. You can also just generate a temporary email address if you don’t require any ongoing communication and the account is not super important.
Even if your alias is leaked they can remove the + part and it’ll lead to your original email without aliases. They probably do some data formatting on emails to no get caught so easily and obviously.
Catch-all address 😎
I use either, depending on the application.
Also 2FA. You’ll still want to change passwords but it buys you time.
deleted by creator
Don’t forget unique email addresses. I’ve had two spam emails in the last 6 months, I could trace them to exactly which company I gave that email address to (one data breach, one I’m pretty sure was the company selling my data). I can block those addresses and move on with my life.
My old email address from before I started doing this still receives 10+ spam emails a day.
I’ve started using {emailaddress}+{sitename}@gmail.com i.e. myemail+xyzCompany@gmail.com
That way I can at least see who sold my info. I wish I would have started doing this long ago though. Some sites dont let you use the plus symbol even though it’s valid though
This trick is common enough and trivial to reverse engineer. I can just purge my billion-email-address hacked list of all characters between a + and an @ and have a clean list that untraceable with your system.
Right? Has this ever worked for anyone? I’ve never bothered because of how easy it is for spammers to bypass.
Spammers go for the easiest targets. If you do stuff like this, they might redesign their system to make it LESS likely to send to you. Keep in mind theyre targetting the elederly, mentally handicapped, and the emotionally desperate. They specifically DO NOT want to target the educated, technologically literate, and those that will waste their time. By attempting to technologically limit them from their scams, you make it more difficult for them to target you and it makes it obvious theyre not worth your time.
Its not about making yourself scam proof, its about making yourself an unappealing target.
(This all applies to scam emails, dunno if it has any effect if the goal is phishing but i would imagine so. If they can phish 5 people in the time it takes to phish you, youre no longer their target.)
Edit: this is why scam emails look obviously scammy, with misspelled words and grammarical errors. Its not a mistake, its an attempt to preemptively weed out people who want to waste their time
Which one works on all browsers including mobile safari and mobile Firefox?
Bitwarden
Bitwarden has been good for me, but I actually don’t know about safari…
It works with Safari. I use both Bitwarden and mobile/desktop Safari.
Thank you for actually answering the question.
On mobile, Bitwarden is an app that fills login/password info into your browser.
So you have to switch over to it every time you need a password?
No. When you click into a password field it puts a password field above your keyboard like word suggestions.
It is not seamless, but it is not a pain in the ass. If you have ever used the keychain or passwords app from Apple it works like that.
Not an iOS user and it certainly seems like something they would be behind on, but with Android every password manager with a Android app will work since the hooks are built directly into Android. Other than websites and apps that don’t implement passwords properly it works pretty well.
Keepass does a pretty decent job. I have keepassXC on my Windows, Debian and Android devices. On Android it’s integrated into the phone(and the autofill service if actual 2fa isn’t supported on the app) so it works on every application. With IOS though I know they can be a stickler on anything remotely technical so I’m not sure if something similar exists with it. I also use syncthing as the service to make sure the same copy of the database is on each device to prevent having to use a password manager that requires a subscription for a cloud service, this also minimizes my risk factor of a cloud service being compromised.
For mobile safari Bitwarden (and I think a number of others, but Bitwarden’s the only one I can speak to) ties into Apple’s password management system for autofill and password generation. Still have to use the app or webpage (either Bitwarden’s official site or self-hosted vaultwarden) for more in depth management.
For mobile Firefox, on iOS it’s the same as Safari. On Android you can either use the Bitwarden add-on or use it with the app and Android’s built-in password management system just like on iOS.
Since you mentioned “all browsers” for chrome/chromium based browsers there is also on add-on for both mobile and desktop. For Internet Explorer and pre-chrome Edge I don’t believe there’s an add-on but it can still work, it’ll just be more of a pain since you autofill either won’t work or will be spotty. You’ll probably be relying on the standalone desktop app.
On MacOS it integrates with Apple’s password management, so no need for an add-on on desktop safari.
For other browsers, you’ll probably have to use the desktop app and manually copy/paste just like for IE.
I also remember seeing some third-party integration for the windows terminal app and various Linux terminals, but I can’t really speak to their quality or functionality since I haven’t used them. But that would probably cover your needs for terminal based browsers like Lynx.
Thank you! You may have finally convinced me to go this directions
I assume Firefox desktop is also supported on Windows and Mac?
There’s an add-on for the browser for both, but on Mac, the desktop app is what integrates with the system wide password manager. I don’t know if desktop Firefox is integrated into that, so you may need both the add-on and desktop app to get the same systemwide functionality.
On Windows it’s worth having both the browser add-on and desktop app installed as well, since the browser add-on only works in browser but the desktop app, while somewhat hit or miss whether or not it works with any specific application, is supposed to provide autofill/generation capabilities anywhere you have username/password field.
Heard great things about bitwarden. I’ve personally been using 1Password for over a decade.
I’ve heard great things about Bitwarden, Vaultwarden, 1Password and Keepass, although the latter may fall out of preference rapidly. Some also recommend the Apple Cloud key storage. Call me a stickler but I haven’t trusted Apple security since the Fappening, even if it was the victims’ fault for not using 2FA
If there’s one thing I’ve always been wary of, it’s the password manager browser extensions. And I’ve been proven right. Don’t be lazy, it takes 30 extra seconds to do it manually.
Pishing detection is nice though, I’ll admit.
There are two major threats to a password manager:
- Breach - if the server doesn’t store the key and data is encrypted, they’ll have to break the crypto
- Client - if the client can be compromised, they can intercept password entry
The second is much harder to mitigate, but also much harder for an attacker to pull off since they need to compromise the update delivery chain.
Whatever client you use, make sure you trust the update mechanism.
I’m a big fan of the Keep It Simple (KISS) approach, and went with Password Safe. Works on Linux, Windows, MacOS, iOS, and Android. It’s big thing is it just makes an encrypted password file which then you can sync between devices however you like (Box, Dropbox, etc)
Which one works on all browsers including mobile safari and mobile Firefox?
It has an auto-type and copy feature, so no need for browser support. Though, the main criticism of this offering is if you want a ton of features and don’t care about KISS.
Something to keep in mind about not using browser integrations is that you can fall victim to simple keyloggers and clipboard stealers. But using an extension can also be a weakpoint if it autopopulates incorrectly or on a compromised site; but that’s far less common.
But, dear readers, don’t let that dissuade you: even a text file in a veracrypt volume is better than “PurpleElephant1994”
I would dare say PurpleElephant1994 is already much better than most passwords people have been willingly tell me.
I recently found out a family member’s passwords are things like “1100011”, “1111000” and similar variations. It’s like they’re already using binary to give a helping boost to brute-forcing bots.
In theory auto-population is way more likely to save you from getting scammed because it won’t do it for a fake site, as the URL doesn’t match. In practice though most people are just going to be annoyed it didn’t work and do it manually anyway before they realize why it didn’t work.
Autopopulate is probably less likely to mistake I and l or O and 0 in a fake url though.
One second, let me just
PurpleElephant1994!
Keychain should work in both now. (iCloud passwords)
And when that password manager gets cracked?
Just as an example, 1Password has a secondary encryption key that they can’t even recover. If you lose it, you’re fucked. I doubt the chances of that being cracked are any good at all.
Bitwarden has no secondary key, and the master key is never sent to the server. All they get is an email address and encrypted data. If you forget your key, your passwords cannot be accessed, which means an attacker is screwed too.
There are tons of ways to give yourself ways to “recover” your password that don’t compromise you in a breach scenario:
- logged in devices - they have the key decrypted and can generate a new one, re-encrypt, and overwrite the data server-side
- store a physical copy of the password at home somewhere (notebook?)
- share passwords with a trusted person (SO) for critical shared accounts
- securely store an unencrypted backup of your password vault (say, on a personal computer with full disk encryption)
Maybe that’s how 1password works, idk, but I do recommend verifying that there’s no password recovery option on whatever password manager service you use.
Got any examples? Because I have…some…examples of password reuse being a real-life problem.
LastPass recently, check Addie Lamarr’s channel on YouTube.
LastPass is the maximum shit. They got hacked like 3 times in a year and my company‘s password notes got leaked.
We are now with Bitwarden and this was the biggest security hardening measure we have taken.
Make sure whatever password manager you use doesn’t store the key on their servers. Bitwarden does this correctly (if you lose your PW, Bitwarden can’t recover it), and I’m sure some competitors do as well. LastPass apparently didn’t.
I seem to remember that the passwords were encrypted so, all they got was the passwords people use for their password manager which because people were using the password manager and therefore had random passwords it didn’t really matter hugely.
Yes and no; they have their own issues:
https://cybersecuritynews.com/hackers-weaponize-keepass-password-manager/
I assure you, the rare security issues for password managers are far preferable to managing compromises every couple weeks.
I’ve only really been in one breach. This one is actually a breach of a “security firm” (incompetent idiots) who aggregated login data from the dark web themselves, essentially doing the blackhats’ work for them.
This is also EXACTLY why requiring online interactions to be verified with government ID is a terrible idea. Hackers will similarly be able to gain all possible wanted data in a single location. It’s simply too tempting of a target not to shoot for.
If you think you’ve only been in one breach, you’re probably mistaken or very young. I don’t know how many breaches I’ve been involved in, but it’s at least double digits.
I’m American, and my Social Security number has been leaked multiple times. Each time I’ve done everything possible to secure my accounts (random passwords, TOTP 2FA where possible, randomized usernames, etc), yet there’s always a new breach that impacts me.
I’m not too worried though. My important accounts are pretty secure. I use one of the few banks (brokerage actually) that provides proper 2FA. My email and password manager use 2FA. My credit is frozen. Breaches happen, the important thing is to limit the impact of a breach.
You’ve only been in one breach that you know about so far!
Lucky you, I’ve been in at least 21 confirmed breaches so far.
Which I don’t really care about, as I’ve been using unique passwords and a manager for well over two decades now. 178 of them, currently. …half to websites that probably died a decade ago.One of my breaches was just Google Chrome (back when I used it) logging me entering my password in a self-hosted local web app via https but with no cert… Google. My breach was Google.
I currently have 110 unique user+password combos. I wouldn’t want to change all those even once, if I were breached and had used similar credentials everywhere.
Bitwarden keeps them well managed, synced between devices, and allows me to check the whole database for matches/breaches via haveibeenpwned integration. Plus because I prefer to keep things in-house as much as possible, I even self-host the server with vaultwarden walled off behind my own vpn, instead of using the public servers. (this also means it’s free, instead of a paid service)
For everyone else reading, bitwarden is an open source free password manager. The pro features are less password related and more about sharing access, file storage, and 2fa authenticator integration
Fair point.
The self-hosting part was mostly about total control over my own systems and less about the paid features. It’s very much not necessary.
As far as pro features go, It was the TOTP authenticator integration that was kind of important to me. ~20% of my accounts have TOTP 2fa, and bitwardens clients will automatically copy the latest 2fa code into the clipboard when filling a password.
Bitwarden will even tell you if a saved account could have 2fa (the service offers it), but it’s not setup/saved in bitwarden atm.
That’s fair. I use Aegis for OTP, but more frequently I get services pining at me to make a passkey, which Bitwarden also handles.
Don’t download shit from random websites… make sure its from legit places…
legit places…
My university, 23andMe, Transunion, Equifax, CapitalOne, United Healthcare…
You shouldn’t download KeePass from any of those.
Legit means the keepass website… those are not legit places to download the password manager
Yeah UHC sold my data as soon as I was put under their coverage. Now I get so many phishing emails pretending to be from UHC.
These kinds of breaches are at the site level. Not much you can do as a regular user if the company doesn’t hash or salt their passwords, for example.
I believe they are replying to the article you posted in regards to the download from legit sites comment, not the fact that the sites have shit web practices (which while correct is a different thing).
To the people who didn’t read the article posted in the comment prior, basically the software installed wasn’t the legitimate software, it was a modified software that was a trojan that was forwarding passwords stored in the keepass database to a home server.
That’s not something that the sites are going wrong, nor is it the password managers fault. That’s fully the users fault for downloading a trojan.
Not from what the article says
involves compromised download links and trojanized versions of the legitimate KeePass application that appear identical to the authentic software on the surface, while harboring dangerous capabilities beneath.
Oh, so don’t use unique passwords? Sure buddy.
deleted by creator
A password manager is still a good idea, but you have to not use a hacked one. So only download from official sites and repositories. Run everything you download through VirusTotal and your machine’s antivirus if you have one. If it’s a Windows installer check it is properly signed (Windows should warn you if not). Otherwise (or in addition) check installer signatures with GPG. If there’s no signature, check the SHA256 OR SHA512 hash against the one published on the official site. Never follow a link in an email, but always go directly to the official website instead. Be especially careful with these precautions when downloading something critical like a password manager.
Doing these things will at least reduce your risk of installing compromised software.
The company I work for forces everyone to do a training every year that goes over all of that and a few others. I assume most larger companies do the same.
None of this has anything to do with password managers, but knowing how to install stuff properly.
Irony
Proud that my only pwned password is three decades old.
I’ve been “pwned” four times.
None of them due to my end. Every single fucker was a piss poor company security
Stuffing? Just in time for the holiday season!
moans “stuff me santa”
Santa: “we are skipping that house”
This is the type of unhinged shit I signed up for!
The thing about this one is no one seems sure of the source (it appears to be from multiple sources, including infostealer malware and phishing attacks), so you don’t know which passwords to change. To be safe you’d have to do all of them.
Some password managers (e.g. Bitwarden) offer an automatic check for whether your actual passwords have been seen in these hack databases, which is a bit more practical than changing hundreds of passwords just in case.
And of course don’t reuse passwords. If you have access to an email masking service you can not only use a different password for every site, but also a different email address. Then hackers can’t even easily connect that it’s your account on different sites.
How do they do that without sending your actual passwords somewhere off your device, or downloading the full list of hacked passwords?
More details about the k-anonimity process. https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/
The short answer is that they download a partial list of passwords that hash to values starting with the same 5 characters as yours and then check if your password hash is in that list locally. This gives the server very little information about your password if it was not breached and more if it was (but then you should change it anyway), making an elegant compromise
They probably hash the list of hacked passwords the same way your passwords get hashed and check for matches.
Interesting, thanks!
They connect to the Have I Been Pwned database in a secure way.
They make a hash of your password and send just the first characters.
Yeah gotta make sure you never use the same password in multiple places, use a password manager.
Is there any info regarding how old this data is?
The breach occurred in April 2025.
During 2025, the threat-intelligence firm Synthient aggregated 2 billion unique email addresses disclosed in credential-stuffing lists found across multiple malicious internet sources. Comprised of email addresses and passwords from previous data breaches, these lists are used by attackers to compromise other, unrelated accounts of victims who have reused their passwords. The data also included 1.3 billion unique passwords, which are now searchable in Pwned Passwords. Working to turn breached data into awareness, Synthient partnered with HIBP to help victims of cybercrime understand their exposure.
This was added to Have I Been Pwned on Nov 6
Oh no, some Russian troll farm now knows my favorite color.
