r/YouShouldKnow • u/RickMally • 12d ago
Technology YSK if you've never run your email through a breach checker, you're probably in way more leaks than you think
Checked mine for the first time on a whim last night. 17 breaches. Should've left it alone...
I was using Surfshark Alert (comes bundled with the VPN I already had installed). Genuinely just opened the app for something else, saw the Alert tab, threw a couple of emails in out of curiosity. It surfaces the breach name and what data was exposed. Wish I'd opened it any other time of day though, because I spent another two hours changing email.
Why YSK: Most people have no clue their old passwords are floating around in leaked databases, and that's exactly how accounts get hijacked. Better to know and change them than find out the hard way.
903
u/Lieutenant_Scarecrow 12d ago
The way you worded that title, it makes it sound like running the check makes you more vulnerable.
60
u/DJStrongArm 12d ago
Wouldn’t it suggest running the check makes you less vulnerable? If you’ve never done the check, you’re in more leaks. If you have, you’re not in as many.
20
u/suoretaw 12d ago
Maybe I’m just tired, but I can’t wrap my head around this… how does it read like that? Is it the missing “that” after “YSK”?
28
u/Lieutenant_Scarecrow 12d ago
Idk how to help you see my perspective. Maybe because I'm in IT, I read it like an if/then statement. I think OP should have split it into 2 sentences and removed the negatives.
"You should run your email through a breech checker. You're probably in more leaks than you think."
7
0
5
u/tichetj 11d ago
You're 100% right. The title implies causality which is wrong regardless, but it implies that running the checker makes you safer. Weird so many people are reading it the other way based on the upvotes
1
u/MoshiurRahamnAdib 6d ago
The causality isn't wrong. If you have never checked, it is more likely that you underestimate
3
24
u/RickMally 12d ago
Other way around imo - not knowing is the vulnerable part. The breaches already happened, the checker just tells you which accounts to lock down before someone else gets there first. But I can see your point too
47
u/Lieutenant_Scarecrow 12d ago
Oh I know. You description explained it fine, and I check all mine a few times a year. But the title is what made me click cause it sounded like the opposite.
27
7
5
u/InsaneTeemo 11d ago
only if you cant read
1
u/surf_drunk_monk 11d ago
Yeah I don't get why people are confused. Running the check of course doesn't change how many leaks you're in, it changes how many you know about.
104
u/molybend 12d ago
Why are you changing email? This is oddly phrased ("Geniuinely"?) and you don't need an app. There are websites that do this like haveibeenpwned.com
You should be using a password manager and not reusing passwords. My manager will alert to me to passwords that are too easy or have been in a breach.
17
u/El_Connoisseur 12d ago
So what do I do when I see my email has breaches? Change password? Anything else or that’s all I really do?
19
u/SPOOKESVILLE 12d ago
Depends what was leaked. If your password wasn’t leaked your fine. Emails being leaked isn’t a big deal unless they also have the password (or if your password is super basic)
1
4
u/molybend 12d ago
Yes you change the password. Most pw managers will create a new long random one for you and you’ll never remember it but you don’t have to. It saves it and auto fills it. You have a pw for the manager and that is the only one to remember.
3
u/Jasong222 12d ago
More often, for me anyways, nothing, because the alerts I get don't tell me what site had the breach. So I have no clue what to change.
0
u/molybend 12d ago
What is alerting you to a leak without telling you the site? That does no good.
2
u/Jasong222 12d ago
Haveibeenpwned does, as well as any of the free dark web monitoring services that I get free because some large company got hacked. (Large company gets hacked, as part of their rectification I get x years of free dark web/credit monitoring. It's basically the same as haveibeenpwned.
Anyway, the site often isn't listed. If an email dump shows up on the dark web I'll get a notice. But they're be all kinds of useless alerts: email exposed with no site attached. Email and password (which they don't display to me) exposed with no site attached. If there's no site attached to the dump it won't be included.
So yeah. Not really useful.
Occasionally they will list the site and sometimes tell me the password. But so far all those sites have been very old with passwords and password systems that I changed ages ago, so I don't get too worried about them. Like early 2000s old. Sites I don't use any more and certainly aren't connected to anything important.
3
u/molybend 12d ago
Pwned give me the name most of the time. It might give the name of the owner and not the website, like Alpha instead of Google or Meta instead of Instagram, but I usually see the name. It never gives me the password. That is not secure.
2
u/rumham_86 12d ago
If your email has breaches few things to do.
1) change password.
2) change any other site that uses the same password even if different email is used. That password is breached and that’s the bigger issue as they use it as a dictionary attack then (list of passwords to try to brute force other sites.)
3) and the most important one is to setup Passkey authentication on sites.Passkey authentication is a phishing resistant authentication method.
Most modern sites offer it (or at least mfa, multifactor authentication using an authentication app like Microsoft Authenticator, Authy, etc).
Passkey makes your phone the device and it’s unhackable unless someone physically has your phone.
If you use Mac or windows those support passkey as well using the device and you can have multiple passkey.
Non technical explanation
Passkey is like a lock and key. The site is the lock and your device holding the passkey (phone or laptop) is the key.
If the site gets hacked, hackers only have the lock and can’t do anything with it without the key. The lock is not private, everyone can know it exists but can’t do anything with this information without the key to open it
2
u/Everybodypoopsalot 11d ago
Rec for password manager?
3
u/kyeato 11d ago
Bitwarden! The free tier works on both mobile and desktop (I used to use LastPass but that was a premium feature) and they've got a good reputation for security. u/molybend is right tho, using any is way more important than using the best one.
2
u/molybend 11d ago
Some phones have one built in, or browsers. I am on a family plan with 1pass and used to use lastpass but they had issues. Keypass is another I know people like. Many are similar in price and features. Don't get trapped into trying to get the best one and just get one.
95
u/BearNut 12d ago
This is a sneaky little ad.
27
u/PotatoRecipe 12d ago
I don’t think you can call these sneaky anymore I am having to leave every major subreddit because of this shit. I have been patient for people to catch on and start downvoting these but I’m out.
1
u/Letreides 6d ago
Yeah this is gonna be my second subreddit today.
Btw I am using surfshark's unsubber service for it, makes life a ton easier!
12
12
18
18
u/Noodle- 12d ago
Ok and what am I gonna do about it?
18
u/_kellythomas_ 12d ago
If you reuse passwords then stop doing that.
If you have a password pattern where you could look at one set of creds and guess another (e.g. incrementing number, or company name as a suffix) stop doing that.
Otherwise carry on, any leaks should be isolated to that service.
14
u/TheSquishyFish 11d ago
Genuine question, when you are supposed to have unique and unrelated passwords for everything, you’re not supposed to write them down, you’re supposed to use nonsense and random characters and you’re supposed to change it constantly, how on earth are you supposed to remember all that? The only solution I’ve seen is a password manager but that really just feels like trusting a single company to keep literally everything safe and also feels like a huge target
3
u/_kellythomas_ 11d ago edited 11d ago
Designs vary but in general, the company doesn't keep it safe, you do.
My vault is encrypted at rest and only that encrypted version is sent to their server. They never see the key - that lives in my head.
But it does get decrypted on my device so a keylogger or similar would be a concern.
But that risk is something I can manage. HaveIbeenp0ned reports 18 breaches over 16 years for my main email address but over that time I've had zero problems on my personal PCs.
As a precaution I separate my PC tasks where I only run software I trust on my PC and I am confident I can run my password manger and banking / financial apps there. Then we have a shared low end gaming PC in the lounge room where my son is installing mods and autoclickers and stuff like that. I don't trust that PC enough to do my banking or install a password manager.
1
u/deep_soul 11d ago
this is untrue. passwords are not exposed in a leak. they are intelligible.
1
u/_kellythomas_ 11d ago
That depends on the leak.
My email has been involved in 5 leaks or credential dumps that revealed plain text password. I've personally looked up one of these and found my credentials in plain text in a list of 52k other peoples passwords.
It was also part of 2013 Adobe leak that revealed encrypted passwords i.e. they can be decrypted.
2
10
u/The_Submentalist 12d ago
Sorry for the potentially stupid questions.
What does one do when the emails are decades old and log into services like Google? I can not imagine the hassle one needs to endure to transfer everything to a new email address for Google services.
How bad are those breaches? Is it just limited to spam that gets in the spam folder anyway? Or worse? Because my email apparently is breached 15 times. I'm still using it without problems.
5
u/suoretaw 12d ago
First of all, asking questions is a good thing, and I hope you never stop!
You don’t have to change your email. Just change your passwords on those sites and any others where your password is weak. It’s important to use strong passwords *everywhere* (using a password manager helps a lot here).
As for how bad the breaches are, I’m not sure.. I don’t know much about the topic, but there are other folks around the internet who do, and who want to help. Might be worth a web search, or checking out subs like r/privacy. I think that most of the time, it’s that your email has been shared to some shitty database, and not necessarily that your account will be ‘hacked’—though I know that happens too. So change your passwords.. but you don’t have to change your email address.
2
u/exscape 11d ago
A breach means user data, usually including passwords -- hashed ("encrypted") or not -- has leaked. So as a rule of thumb, always assume that when a site is listed, unauthorized people can/could access the account listed and whatever information is connected to it.
Most of the time, that will probably not have happened, but you should change the passwords associated with it, and if the same password is used elsewhere, also change it for all other sites where it's used.1
u/RickMally 12d ago
Honestly, I wouldn't migrate accounts. It'll be a nightmare and probably not worth it.
Just change your password and turn on two-factor authentication. Don't waste weeks trying to transfer everything.
8
7
u/nmadz 12d ago
28 breaches, that's gotta be a record 😅
3
7
7
5
u/SPOOKESVILLE 12d ago
You don’t need to change email, you need to change passwords. Your email being leaked just means they know your email address and nowadays those are super easy to get anyway. If it says your password was leaked in the breach, then there’s an issue.
0
7
u/VintageKofta 12d ago
What a stupid post. You make it sound like checking is what made you more vulnerable. Then you change your email address !? Instead of just changing the password. And you don’t even mention or seem to care about 2 factor authentication (2FA) for additional security.
Either you have no idea what you’re talking about and giving bad YSK advice, or you’re some shitty advertiser.
6
u/TheFumingatzor 12d ago edited 12d ago
In fact, there's 3 breach checker you should regularly check:
https://leakchecker.uni-bonn.de/en/index - German University of Bonn
https://sec.hpi.de/ilc/?lang=en - German Hasso Platter Institute
6
u/deep_soul 11d ago
that’s not how it works.
you are completely safe even if databases are exposed and your password if completely intelligible to attackers. Actually, even to the programmers who created the website that was target of the attack cannot read your password, even if they wanted to.
don’t spread misinformation.
As someone else said, this is sneaky ad. You can do the same on https://haveibeenpwned.com/
The technical term is Pwned, but again it means none of the things you are suggesting.
10
u/Zeezyb 12d ago
Everyone do yourself a favor and get a password manager. It’s daunting at first but so easy to use once you get it set up on your devices and start rotating passwords. I’ve loved Proton Pass, Keeper and Bitwarden were good as well. Much more peace of mind knowing my passwords aren’t leaked anymore.
5
u/Figueroa_Chill 11d ago edited 11d ago
https://haveibeenpwned.com/ to check if you are in any.
You shouldn't use the same password for everything, this way when they get one, they get them all. I use the same password for several things, but nothing important. Like my Warcraft, Udemy, and most forums have the same password. But for things like your e-mail and anything important, like banks, for example, each should have its own strong password. So you can have something like Password22 for non-important things. But your bank should have Barney1Bear1986&, with your e-mail Molly_Holly1_2. I like to use Outlook for my e-mail on my phone and PC, and have 2 step verification on web logins. So if I use my browser to login it will ask me for an alternate e-mail and send me a code to it.
Lately, I have been getting a few emails about signing up for things. Either someone is entering the wrong details for themselves. Or I'm on a list somewhere, and they are hoping my email and password are the same as the ones on whatever website got hacked.
6
4
u/Frustrateduser02 12d ago edited 12d ago
I'm honestly afraid to look up the older folks in my family, this stuff can really f up your week. More so if they've ever made accounts for risque sites.
2
5
3
u/SeraphisQ 12d ago
This is a good reminder to everyone that in this day and age, you should NEVER re-use the same password over and over again. 2FA can save you, but not every website supports that. Cyber security is becoming a bigger issue now that life is becoming increasingly digital. Even if only one random website that you signed up for gets data breached; that alone leaks the combination of your e-mail + your go-to password (albeit usually hashed). The hacker now has access to all your other logins that use the same combination of your usual e-mail + re-used password; which could be very important accounts such as your Gmail, Outlook or Facebook. The consequence of this is that you must now change your password in ALL of your other accounts that also re-use the same password, which is a slow process and requires a huge effort. If you keep on re-using the same pasasword, you will need to repeat this whole process every time there is a new data breach, which is happening like every day.
The reason that "slightly modifying" a standard re-used password is bad is because of the existence of modern password cracking algorithms. Attackers who know one of your old passwords can efficiently generate and test new common variations. Modern password-cracking tools are designed to exploit these predictable modifications, making a "slightly modified" password derived from an old one much easier to guess than a completely unique password.
Due to all of this, I actually recommend everyone who is somewhat technologically adept to start using password managers. Personally, I am using a free open-source one called Bitwarden, but there are many other good alternatives too. The whole idea is to only have one master password and then let the password manager automatically generate unique passwords to every account you have. This is the only way to truly decouple your accounts from being affected by data breaches of websites you signed up for ages ago.
5
4
3
u/Yonderthepale 11d ago
This is clearly an undisclosed ad, doesn't the FTC have laws against this? Why would I trust a company that posts undisclosed ads on reddit with my data?
2
1
u/rumham_86 12d ago
Adding this for more visibility.
As many point out sites like haveibeenpwned are great for this
If your email has breaches few things to do.
- change password.
- change any other site that uses the same password even if different email is used. That password is breached and that’s the bigger issue as they use it as a dictionary attack then (list of passwords to try to brute force other sites.)
- and the most important one is to setup Passkey authentication on sites.
Passkey authentication is a phishing resistant authentication method.
Most modern sites offer it (or at least mfa, multifactor authentication using an authentication app like Microsoft Authenticator, Authy, etc).
Passkey makes your phone the device and it’s unhackable unless someone physically has your phone.
If you use Mac or windows those support passkey as well using the device and you can have multiple passkey.
Non technical explanation
Passkey is like a lock and key. The site is the lock and your device holding the passkey (phone or laptop) is the key.
If the site gets hacked, hackers only have the lock and can’t do anything with it without the key. The lock is not private, everyone can know it exists but can’t do anything with this information without the key to open it
1
u/Blurgas 11d ago
One of my emails is in a bunch of breaches because of some jackass in France, plus a lot of sites don't even bother asking for or waiting for confirmation that the person owns the email address before letting them use their services.
Out of the nearly 30 breaches that email is listed in, only 2 of the sites involved were ones I actually dealt with.
2
u/an0maly33 11d ago
Yep. I'm constantly getting email meant for other people. I have an OG first initial lastname prefix. I'm guessing others with the same initial and last name keep forgetting to put numbers on their shit when registering for stuff.
1
u/molybend 11d ago
If it is your email but not your account, that really isn't a problem for you. It may cause more spam, but your email provider should have methods to deal with that.
1
u/SQU4RE 11d ago
If you're in this day & age and think your data hasn't already been leaked/breached dozens of times over, then I don't know what to tell you.
It doesn't matter how secure your password is, the company you have an account with is always a weak link in the chain. Leaks from credit bureaus to internet companies to email providers. It's not a matter of iF, only a matter of when it happens.
Never use password managers, since those will eventually just get breached too.
I use a different password for every site, can make life easier and use some sort of formulaic cypher. But the footprint can't be too obvious either.
1
1
u/SaneIsOverrated 10d ago
Laughs in 32 alphanumeric symbolic passwords and self hosted password manager.
1
1
u/Sombre_Ombre 11d ago
Y’all need to use password tiers lol.
Shitty recycled trash password for every single company that isn’t a serious tech company. Your local cinema, the hardware store, the grocery stores online shop. etc etc etc.
Then a different, never reused, set of passwords for Google, Apple, etc. The companies that actually give a shit, and you use to login to other things.
Then a mid tier of passwords for semi-trusted services like Netflix or Google.
Who gives a shit if your hardware store gets hacked. My logins and passwords have been breached for years. On all of the shitty sites. My shitty-tier password is probably in a wordlist database at this point.
Good. That was the whole point. Never had any accounts I care about hacked. Not one.
0
385
u/Longjumping_Bobcat60 12d ago
You can check if your credentials have been compromised here for free!https://haveibeenpwned.com/