Just spend 2 minutes and change your password instead of spending 2 minutes thinking about whether you should.

There are downsides to asking people to change their password for everything! (even though this is a big "everything")

I remember some services send you a message telling you to change your password anytime a new device logs in or even fails to login to your account. That causes most people to pick weaker passwords, since they're not all using manager apps.

Then you would not be solving the problem because you need to change everywhere else you used that same password.

If that is the problem you have a different problem. Don't reuse passwords.

Reusing passwords is one of the single dumbest things you can do online these days. Do not recycle passwords. Ever.

Why? Any breach that involves usernames/passwords are account name and password combos that get tried on EVERY POSSIBLE SITE after.

It only takes one pair of username with a reused password for this to work.

Use a password manager.

Just don't worry about it and go through the password reset anytime you log in.

That doesn't make any sense. Password management isn't really that complicated:

Use a password manager, and reset your password if the service has been compromised.

What do you do when the PW manager is compromised?

Cry? Realistically speaking, this isn't going to happen without physical access to your computer or malware, though. So don't leave your computer unattended and don't download sketchy things.

Expecting people to simply memorize a unique, strong password for every single website that they use is unrealistic. Of course, no solution is perfect, but that doesn't mean we shouldn't improve the current situation of people reusing passwords with maybe slight modifications per website.

Password reset is easy and free. Why go to the trouble of a password manager, especially for dumb stuff like grocery coupon cards?

Shouldn’t the hash be salted and useless elsewhere?

In theory, it should. In practice? Who knows.

In practice it'll be plaintext stored on someones hard drive.

Outside of the same authentication domain with bad auth token practices (windows) the hash almost always is useless elsewhere. Salting increases the complexity and thus size of hash tables or hash comparison (rainbow tables), but if your manage to break or brute force the entries, salted or not, the secret often is reused by many users.

Provided that its hashed with salt / diff methods, sure - but how can you be sure?

That's not what salting does, and different hashing methods are irrelevant. The danger of having your hash leaked is that it can be cracked and the plaintext password recovered. The hash itself is entirely useless for logging into other services.

t. infoseclet

It can still be cracked

This is the SHA 256 of a phrase... go for it!

7BB7DB877943832837046863EF45C252D3A08C92A273F7B665210A6E12701095

A phrase almost certainly has a lot more entropy than the layman's reused password from other leaks.

If this is a phrase to unlock a bitcoin account with 1000 bitcoins in it, then you can easily convince people to try and brute force it.

Do you have Amouranth's or xQcOW's salted hash from this leak? Might be worth trying to brute force it.

You try on those kinds of accounts because they might have re-used it or the password might be patterned or not completely random, which gives you a chance that the credential might give you access elsewhere.

good luck hacking my password horse correct battery staple