Everything You Need to Know About the Massive Russian Hack (I'd advise all to change your passwords)

[trumad]

It seems like every couple of months these hacks are happening and we are told to change our passwords. Yeah I know it's a pain in the ass but it's the price we pay for playing on the tubes. You don't have to change your passwords---that's your choice----but you are laying yourself bare for future trouble.

Welcome to the 21st century folks!

Russian hackers have stolen 1.2 billion Internet user credentials. Here's what you need to know.

http://time.com/3089473/israel-gaza-hackers/

On edit: Best advice is to write out on paper all the sites that you hop onto that require a password. Change the passwords and make sure you don't use the same password for all sites. I personally put my passwords in a little notebook that keep at home in my desk. Yeah sure it could go missing.. but I doubt that will happen. The do have encrypted password safes on the net and they work just fine. Usually it's a pay service.

Good luck

[djean111]

1. Will do. I only want one government at a time to know my passwords and such!

[trumad]

2. LOL---

I need to get into the habit of changing my key passwords at least once a month. Banking, etc.

[liberal N proud]

3. Again? I just changed all them from the previous attacks

I can't keep coming up with unique passwords that contain at least one upper case and one lower case letter, at least one number and a special character that are at least 8 characters long. None that I can remember anyway.

I need a database just to keep my passwords, but then the database will get hacked and I am screwed anyway.

[trumad]

5. Like I said...

Write it down or get one of those secure password holders on the net.

Still a crap shoot either way.

[hlthe2b]

8. You can purchase apps for pc and smart phones and set them so they don't share

info anywhere--just manually sync. I surely would not go with one of the cloud services. Not in a million years.

[CrispyQ]

27. It's ridiculous, isn't it?

I hate when I come up with a password & then get a message that it contains unacceptable characters or it doesn't contain them or whatever!

I keep mine in Excel & password protect the file & the flash drive the file is on. I keep a printed version at my desk, which gets edited as I add & change passwords & it goes in the shredder when I print a new one. The file is now two pages, front & back.

[a kennedy]

4. bout time I change them anyway.....thanks for the nudge to do so.

and I too keep them in a little notebook.....

[trumad]

6. I'm doing it now..

Banking first-- and then all my bill pay sites, etc. Surprised at how many I have.

[freshwest]

22. Is this is only about banking? I can't get TIME to come through.

I don't do anything online except AMAZON. No banking or buying from other vendors. Wonder if DU will get hacked...

[hlthe2b]

7. Gawd... I use datavault for PC and Iphone app--I've got nearly a 100 login passwords....

Last time around, I changed every single password that held any level of identifying info to a unique complex code for each--after the "https" related hack.

There surely isn't much information provided on this one. It sounds as though they went for the major email sites and probably facebook, twitter and the like. If I were to bet, it would be gmail that was targeted and I don't use it or any other google related crap.

I think I will merely change my primary email password (I don't do facebook or other social media) and leave it at that this time.

[trumad]

9. Bottom line---we are vulnerable

I'm in the Cyber Security biz--- This was Botnet shit rearing it's hidden head.

If folks only new how infected our networks were they'd freak and demand action. Then again-- maybe not.

[hlthe2b]

11. So what do you think was targeted?

I know that even though I use a very reputable credit union--over the big gargantuan banks--that they share info too. They do use triple layer login protection, which seems appropriate--even my utility companies do that.

That said, it just seems to be the big retailers and social media sites that are really lax with security. I've started using paypal as much as possible when I purchase online to decrease how many times my credit card numbers get out there and I change papal password monthly. My billing and shipping residential address are kept separate. Obviously, I am scrupulous about maintaining security on my own machines and every peace of crap mail that comes ot my home is shredded.

I'll be damned if I know what else to do.

[trumad]

12. Nothing is perfect.

Even the little black notebook isn't perfect. I'm probably going to start using my banks bill pay system. One source for all my bills.

Currently I just hop onto the site that I have to pay---electric, cell, etc...and pay on their site. this opens me up to all kinds of passwords and vulnerability.

Best thing to do is only use your pay info on sites that will give you your money back if they get hacked or fraud was committed.

[WillowTree]

19. "I'm probably going to start using my banks bill pay system".......That's a start, but.......

.......you still need to change passwords for lots of things. I pay all of my bills from my bank's bill pay page, but don't forget that sites like utilities (phone, gas electric, water, cable etc) all still have personal info that could be useful to hackers (address & phone #, for instance) and sites where you shop with any regularity might have credit card information (like Amazon or stores where you buy online). Also the sites for any of your credit cards themselves. Even if you actually pay your credit card bill from your bank's site, the card issuer still has your information on their site, so you need to change those, too. And PayPal has your card, and maybe bank account, information, too. Ebay, too.

I use a password manager (be sure to use one that allows you to export your PW data as a backup.....NOT TO THE CLOUD) and I have a list of the sites that I need to change passwords for on occasions like this so I don't forget anything. That way I can just blow through and change the passwords on the sites and update the password manager and it doesn't take a significant amount of time.

[MoonRiver]

10. I have the same system as you trumad.

Just spent a couple of hours changing all passwords. Chose really unconnected gibberish this time. Harder to remember, without my little notebook, but more difficult to hack, I HOPE.

[hollysmom]

26. Well, I have money passwords and board and e-mail passwords -

Money passwords I am very careful with. The message boards - hey you hack them people see odd posts - I complain to admins - other than that, does it matter?
most e-mail passwords are set up for specific things. since I am not using e-bay right now and not using paypal, no money in it., I guess I don't care about them either. Don't shop that much on line mostly because I have enough stuff and don't need to buy anything else. Or I can just pick it up at costco or something. Not buying big ticket items. Do not let my credit card reside on-line, and generally have to report lost credit cards almost annually, and then when the new one arrives, I find the old one - sheesh - I am getting so old!
The banking and they e-mail connected to banking are very carefully monitored. I don't want to sign up for any other banking on-line even though I have 3 checking accounts (you get higher interest rates on a CD if you have an empty checking account.) Even my files on my computer are scrambled or kept on a thumb drive only - and yes I have lost thumb drives but figure no information about who it belongs to on the files.
Hope that is enough, Don't change things monthly, have a coded password sheets with some numbers lited, Igenerally associate one word with different numbers so that Is all I need, but if I die, so do all the passwords.

[IDemo]

13. I'm giving KeePass a try

Free, open source, and looks quite secure:

http://keepass.info/

[trumad]

14. cool

[steve2470]

16. great thread trumad, I'm contacting my credit union and other places nt

[MH1]

21. KeePass is great.

All of the benefits you mention, plus very easy to use.

[steve2470]

15. Russian Hackers Amass Over a Billion Internet Passwords

http://www.nytimes.com/2014/08/06/technology/russian-gang-said-to-amass-more-than-a-billion-stolen-internet-credentials.html?_r=0

A Russian crime ring has amassed the largest known collection of stolen Internet credentials, including 1.2 billion user name and password combinations and more than 500 million email addresses, security researchers say.

The records, discovered by Hold Security, a firm in Milwaukee, include confidential material gathered from 420,000 websites, including household names, and small Internet sites. Hold Security has a history of uncovering significant hacks, including the theft last year of tens of millions of records from Adobe Systems.


Hold Security would not name the victims, citing nondisclosure agreements and a reluctance to name companies whose sites remained vulnerable. At the request of The New York Times, a security expert not affiliated with Hold Security analyzed the database of stolen credentials and confirmed it was authentic. Another computer crime expert who had reviewed the data, but was not allowed to discuss it publicly, said some big companies were aware that their records were among the stolen information.

“Hackers did not just target U.S. companies, they targeted any website they could get, ranging from Fortune 500 companies to very small websites,” said Alex Holden, the founder and chief information security officer of Hold Security. “And most of these sites are still vulnerable.”

[Tuesday Afternoon]

17. And this is why I snail mail all my bills. Call me old fashioned, I don't care.

[steve2470]

18. called my credit union, they were clueless

I asked them politely to put a notice on their website.

[trumad]

20. Yeah---the CSO is probably on vaca

[steve2470]

23. kick nt

[napkinz]

24. does that include passwords for message boards, like DU?

nt

[trumad]

25. I would think includes everything...

Although they will filter only the important ones.

[snacker]

28. Thank you.

Good advice.