article thumbnail

When Accounts are "Hacked" Due to Poor Passwords, Victims Must Share the Blame

Troy Hunt

The first one was about HSBC disclosing a "security incident" which, upon closer inspection, boiled down to this: The security incident that HSBC described in its letter seems to fit the characteristics of brute-force password-guessing attempts, also known as a credentials stuffing attack.

Passwords 238
article thumbnail

Chart a course to the passwordless future on World Password Day

SC Magazine

Today’s columnist, Jasson Casey of Beyond Identity, offers a path for security teams to move off shared secrets and embrace a passwordless world. It’s World Password Day, do the company’s users still rely on passwords? Has the security team replaced them? Eliminate passwords.

Insiders

Sign Up for our Newsletter

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

article thumbnail

The Data Breach "Personal Stash" Ecosystem

Troy Hunt

For example, here's Jordan's go at deflecting his role in the ecosystem and yes, this was the entire terms of service: I particularly like this clause: You may only use this tool for your own personal security and data research. You may only search information about yourself, or those you are authorized in writing to do so.

article thumbnail

What Are the Risks of a Data Breach?

Identity IQ

How to Help Protect Yourself from a Data Breach While the threat to your personal security can be extremely unsettling, regular privacy scans, strong passwords and authentication, updated software, and being mindful as to what you share online, are major preventative measures you can practice daily to significantly help mitigate this risk.

article thumbnail

No, Spotify Wasn't Hacked

Troy Hunt

Very often, those addresses are accompanied by other personal information such as passwords. No, and the passwords are the very first thing that starts to give it all away. The attack is simple but effective due to the prevalence of password reuse. Clearly a Spotify breach, right? Billions of them, in some cases.

Hacking 224
article thumbnail

Mother of all Breaches may contain NEW breach data

Malwarebytes

These shady services, Hunt says, allow interested parties, including criminals, to access records that contain usernames, passwords (including in clear text), email addresses, and IP addresses. It has Terms of Service that include: You may only use this service for your own personal security and research.

article thumbnail

Weekly Update 125

Troy Hunt

But moving forward, it's Microsoft Ignite in Sydney next week and that should be a great event, plus I'm talking about Google's Password Checkup extension and the other credential stuffing list "collections" I keep getting asked about. Twilio is sponsoring my blog this week (they're talking about the PSD2 reg in the EU).

Passwords 135