Re:Have I Been Pwned? Data breach master list with API
by schoen on Monday March 14, 2016 @05:29PM
(#11285711)
> is that pretty much all I should be doing at this point?
Google also offers two-factor authentication; if you're willing to bear the extra inconvenience, it's one of the biggest possible security wins.
Re:Have I Been Pwned? Data breach master list with API
by tyre on Monday March 14, 2016 @08:17PM
(#11286580)
To add to this, it isn't too bad of an inconvenience. You can remember a device for 30 days, so you take an extra 20 seconds 12 times per year.
Re:Have I Been Pwned? Data breach master list with API
by mkopinsky on Monday March 14, 2016 @09:52PM
(#11286947)
I complete a Google 2FA much less than once a month. I think the 2FA cookie must live for a month, but my login cookie lasts for much more than that.
On a new device, I do of course need the 2FA token.
Re:Have I Been Pwned? Data breach master list with API
by putlake on Monday March 14, 2016 @05:53PM
(#11285848)
Changing your Gmail password is not necessarily what you need to worry about because that wasn't compromised. HIBP told you your account at other places e.g. Heroes of Newerth was compromised. So if you used a password for that account that you also used in other places, then you're vulnerable. This is why password re-use is a really bad idea.
1. My two main email addresses were both flagged across the Bitcoin Security Gmail dump, the Gawker Gnosis hit, and then two game DB breaches (D&D Online, Heroes of Newerth). If I've changed my gmail passwords since then with a very strong 1Password PW, is that pretty much all I should be doing at this point?
2. I was never notified by any of these places that my email and password had been compromised. I'm particularly concerned by the two games. Do these companies have any legal obligation to disclose what happened? In the case of D&D Online they have "Dates of birth, Email addresses, IP addresses, Passwords, Usernames, Website activity." So I'm curious what recourse I have.
I have to say that the irony in all of this is that my two personal email accounts were both caught up in multiple lists, but none of my family members (who are all considerably less tech-savvy than I am) show up at all.