Over 1 Billion Passwords Stolen

I understand the need for passwords on bank accounts and credit accounts, but the vast number of sites that *require* one to register is quite annoying. usually, they just want to have their marketing department write, saying, "you just bought a pair of shoes! would you like to buy more shoes?" this annoys this senior citizen on a fixed income.

Bob, I have to agree 100% with your opinion of Hold Security charging a small fee to check peoples e-mail against the 'master list'. Nobody is forcing these people to use their services, it's a choice. If they can't be bothered to change their password, then pay a fee to find out. And who actually tried to cause the panic? Hold Security? or the news media by sensationalizing the news? Your comment about "the pot calling the kettle black" couldn't be more appropriate.

I wonder what the point of using strong passwords is all about anymore. Since stealing passwords is surely much more common than cracking them, why not just use abc rather than some impossible construction of letters, numbers, symbols and caps?

Just this morning I received an email from, most likely, one of those hackers or someone who bought the stolen info. I received an urgent plea for help from someone I haven't spoken with in probably 20-years, saying her family had gone to Kiev on vacation, gotten mugged, robbed of everything but their passports, etc., and the US Embassy wasn't helping any and wanted to know if they could borrow $2,300 from me. The email asked me to reply if they could count on my help and they'd send instructions on how to get the money there.

My PWs are all secure 15-character mixes of gibberish. I have five email addresses, registered at 175 websites. Surely one of those 420,000 sites is among them. Why has none of those sites contacted me about changing my PW? I posed the same question at an old, reputable computer help forum, VirtualDr.com, also with no replies.

Has anyone else been contacted by a hacked website?

Sorry, count me on the side of the skeptics. Sure, "Hold Security" was invisible a year ago and more-or-less before this disclosure; the respectable Brian Krebs vouched for them (although listed as an adviser to Hold Security); they were charging $50 to check an email address (or $120, the prices changes depending on who and when you check); and Bruce Schneier calls the story "Squirrelier and Squirrelier."
I certainly can see not publishing any of the alleged 1.2B hacked accounts, but shouldn't they at least give out some of the 420,000 hacked websites? I want to check mine, but am not willing to sign up for some kind of service just to do that.
The whole story smells much more like a media attention stunt than real news.

Several months ago, g mail notified me that someone in Russia was trying to access my account. I changed my password to a much stronger one as well as all my other accounts. Don't know if it was this band of thieves, but I'm glad Google sent that notice, otherwise I never would have known. Bob, thanks for your great articles keeping us informed.

Bob -- And *I* remember the argument if calculators should be allowed in Stats, Chemistry and Physics classes over slide-rules. Then if they should be allowed for High School, then upper Grad school . . . .

Yep, Academia and Capitalism share much in common in how they react: "DANG! **I** should have thought about it!! It really *WAS* my idea you know!!!" On a more serious note, I'd like to underline your advice given in such Britishesque understatement:

***_CHANGE YOUR PASSWORDS!_***

There, it's been said. AND on the up side, no one needs to think "Dang! *I* should have thought about it!!", and ruin a perfectly good day, unless it's changing passwords. That's always a joy.

Yes, Bob, I have changed 'some' of my passwords recently - like when eBay and PayPal requested it (and wouldn't let you log in using the old one).

But, to me, it's a real pita. I carefully (and I think, skilfully) craft a new password: one that's strong but also memorable to me - because I don't use any programs that memorize passwords for you - that is just one more action you need to take to get where you want to get to, as quickly as possible.

So I shall be continuing with my current ones, while watching and being aware of any signs of unusual activities. Thanks as always for keeping us up to speed.

Proof that it pays to change your passwords often. A lot of Russians are thugs and are hated all over the world for their devious ways, not just cybertheft. All are not thugs, but a number of Russians, many living in other countries, ruin the reputation it for the rest of population.

Bob,

Thanks for all your insightful short stories over the years. SQL injection flaws in a website in 2014.
I wouldn't even think that was possible with all the security experts around now. IT would seem like a good idea before putting a website online for the public that it was tested for known flaws. I wonder if the i love you virus would take down a network today?

Keep up the good work and interesting viewpoint.
Thanks,
Cross site scripting

I think the point made by Joel Brown above is a good one. This excerpt from Bob's newsletter of 15th August seems to show that strong passwords aren't necessarily the answer.

"A few years ago, I met with a group of Internet professionals, all of us sporting laptops with wireless connections to the hotel's access point. On the second day of the conference, one of the attendees put up a slide showing logins and passwords from a dozen of the attendees. Needless to say, many jaws dropped open! He was running a "wifi sniffer" to spy on the internet traffic floating around in the air. Fortunately, he was a trusted colleague, and was nice enough to tell us that we were caught with our virtual pants down".

Those who are paranoidly (and criminally) inclined, it is prime time to:
*Cash out all of your savings and your bank accounts,
*Buy an island home in the some touristy resort, with your 401K plan,
*Rack up all your credit cards to the max, with the best toys money can buy,
*Fire your accountant and investment advisor, via your gmail account,
*Deface and otherwise ransack all your social media (Facebook, Tweeter) accounts,
*Contact Social Security Administration and tell them to lock your account,
*Purge yourself of all your battery operated devices,
*Cancel your ISP, mobile and TV accounts,
*Remove batteries and turn off all your computing and mobile devices, and
*Notify the IRS that all your personal and financial accounts have been hacked and otherwise hijacked because of what Bob Rankin told you.
Enjoy the remainder of your future off the grid and never having to worry about another password!

Hi Bob, I was wondering why acts such as this are almost always attributed to the "Russians". Are they more intelligent, have better computers, more free time, more evil, or some other "trait" that the rest of us don't have?

EDITOR'S NOTE: I didn't use "Russian" in a metaphorical sense. That's where these particular criminals are located. My guess is that criminals in Russia don't have any particular superpowers -- rather, they understand that they can more likely get away with it there, due to complicit and corrupt government officials.

Passwords are a PITA. I use very strong long ones for any account that has email, financial data, or stores credit cards. The rest of them get a very easy one--that way I don't give up any clues if an unimportant account is hacked.