152
top 50 comments
sorted by: hot top controversial new old
[-] drspod@lemmy.ml 132 points 2 months ago

This breach is worse than just a website's database being leaked. These are info-stealer malware logs. Meaning that you had malware on one of your devices that recorded you typing your credentials into websites and then the logs of that malware were publicly leaked.

Before changing all of your passwords (and setting up a password manager if you don't already use one) you need to identify which of your devices was compromised and wipe it.

If you change all your passwords from the compromised device then the malware will just record all of your new passwords.

[-] MrPoopbutt@lemmy.world 18 points 2 months ago

How would one identify which device was compromised?

[-] stinky@redlemmy.com 17 points 2 months ago

Assume all of them are infected.

[-] tetris11@lemmy.ml 13 points 2 months ago

Turn off your computer and make sure it powers down. Toss it in a 43-foot hole in the ground. Bury it completely rocks and boulders should be fine. Then burn any clothes you may have worn any time you were onliiiine

[-] EntirelyUnlovable@lemmy.world 10 points 2 months ago

Wait a sec my grandmother is calling me about some pictures I apparently sent her

[-] Jollyllama@lemmy.world 7 points 2 months ago

Instructions unclear, I don't speak Swahili

[-] Cycle0861@lemmy.world 4 points 2 months ago

Which password manager is good? I use Bitwarden but it would take forever to change all my passwords inside of it

[-] arthur@lemmy.zip 9 points 2 months ago

Bitwarden have a good balance of security, price and convenience. If you want more control and less convenience, KeePass.

load more comments (3 replies)
[-] AtariDump@lemmy.world 2 points 2 months ago
[-] kekmacska@lemmy.zip 1 points 2 months ago

Do you have a clue about what haveibeenpwned is?

[-] countrypunk@slrpnk.net 52 points 2 months ago* (last edited 2 months ago)

Assuming this email is legit, the best thing that you can do is change as many of your passwords as possible to be unique and complex. You may also want to consider deleting old email addresses and getting new ones. Alternatively you can separate your emails addresses by having one for signing up for spammy services, one for personal stuff, one for work/school, etc. Try not to have much overlap between them all.

Edit: I also highly recommended using a temporary email for signing up for stuff whenever possible. I always use this one , but there are plenty of others too.

[-] foremanguy92_@lemmy.ml 11 points 2 months ago

I kinda like https://yopmail.com/ as it's much more customizable

[-] nossaquesapao@lemmy.eco.br 8 points 2 months ago

I like grr.la because I can sign in into the services with any random name @grr.la before opening the temporarily mail site, and sometimes I find out that it wasn't required to confirm the mail, saving some time

load more comments (2 replies)
[-] BlackEco@lemmy.blackeco.com 28 points 2 months ago

For those wondering what this is Troy Hunter (HIBP founder) wrote an article on this new feature.

[-] helpImTrappedOnline@lemmy.world 13 points 2 months ago

Password manager, and use different randomly generated passwords.

The real danger is having the same password everywhere.

Also pay attention to where you save your payment info.

Everything I do online is through Privacy.com, with limits for each vendor. My amazon gets hacked? Most I'm out is $100, steam gets hacked, there goes $60. A subscription tries to double charge, lol no. Free trial wants to auto-bill me after 7 days, its not happening. Funneling everything through them isn't 100%, but at least they're not paypal, I get notified when ever even a 1 cent charge happens and I'm not leaving my bank card on a dozen random sites I'll eventually loose track of.

[-] nichtburningturtle@feddit.org 5 points 2 months ago

Sadly I don't know of an alternative operating in Europe.

[-] helpImTrappedOnline@lemmy.world 2 points 2 months ago* (last edited 2 months ago)

That's unfortunate.

Another thing you can do is to keep available funds on whatever card you use online low. If there's only 1 to 2k on the card, yes it'll suck, but it won't be as impactfull as your life savings.

You a might also consider credit card with a small limit (1k or less) and set auto pay to "pay full balance" every month. Avoid interest like the plague, (those cards have insane interest rates over 20%), but if you're always paying it off in full, there's no interest to pay. If I can't pay the credit card off in full (and I mean the full limit) when I "swipe" it, I pretend it does not exist. None of the "I get played next week, so I can pay it off then" - nope, don't go there.

Supposedly credit cards have better fraud protection than a debit, but maybe that's just another one of our many "Freedom" problems.

The main thing is you're separating the random websites from the majority of your funds to limit how much can be taken. If there's a problem, I'm dealing with Privacy.com and a couple hundred bucks and can still pay the bills. I'm not trying to convince ebayclone#71 and my bank I didn't place an order for 10000 waffle makers before the lights shut off.

And of course, I'm just some rando on the internet, not an actual expert. Not even in same country as you, so take that for what it is.

[-] pishadoot@sh.itjust.works 1 points 2 months ago

I wouldn't recommend keeping credit card limits low to only mitigate fraud risk - credit card companies generally will take the hit for unauthorized use, aka stolen information, and send you a new card. So keeping the limit low in an effort to make sure that if your info is stolen they'll only be able to steal $1000 or $2000 isn't really necessary, and only affects your ability to use credit and have a better credit score (because your % of utilization of your overall credit limit goes into your FICO).

Instead, review your purchases monthly and inform the card company of charges you didn't make as soon as you see them.

DEBIT cards are a different story. They're a direct link to your bank account funds and there's no intermediary that is willing to take a hit, it's your bank vs you, so if your debit card info (and pin) are exposed you're much more vulnerable. So I wouldn't recommend EVER using debit these days, there's zero reason to, but if you have to then your advice in your OP is more appropriate.

load more comments (1 replies)
[-] amzd@lemmy.world 1 points 2 months ago

You don’t need a credit card for most things in Europe so it’s not as pressing. Even if a company leaked my bank account details, no one can charge it by default.

[-] stinky@redlemmy.com 3 points 2 months ago

What if my chosen service doesn't allow me to change passwords that frequently?

load more comments (1 replies)
[-] d0ntpan1c 2 points 2 months ago

Also a note that captial one has a similar service for their own credit cards. Def not as good as privacy.com, but still useful.

[-] helpImTrappedOnline@lemmy.world 2 points 2 months ago

Good to know.

[-] psmgx@lemmy.world 10 points 2 months ago

Start changing passwords mon ami

Get a password manager and just start going from site to site and change em up. Use strong ones and store them in the pass manager. Start with critical ones like banks, email accounts, and government stuff, and then keep going..

load more comments (1 replies)
[-] Broken@lemmy.ml 6 points 2 months ago

Change your password, and hopefully you don't use the same password across multiple accounts. Since you're asking, I assume you do. (Not shaming, just informing)

It would be best practice to use a different email and password for every account you create, and enable MFA. Email aliases work great for this, and use unique randomly generated passwords for everything. A password manager will help you create, remember, and fill these fields for you so its not cumbersome. There are many good ones, I personally recommend Bitwarden. You can get pretty far with their free version, but I recommend paying to get the authenticator built in, so you can auto fill MFA codes.

If you can't afford this, or want to keep the codes separate (not all your eggs in one basket) then download the Aegis authenticator app. Its free and very good.

[-] kekmacska@lemmy.zip 5 points 2 months ago

There was a steam breach too, i changed my email and password for steam as well

[-] italics2@lemmy.world 5 points 2 months ago

Can you provide your source (no pun intended)?

load more comments (13 replies)
[-] CatsGoMOW@lemmy.world 4 points 2 months ago

Change your password(s).

[-] Wolfie@lemm.ee 1 points 2 months ago

Stealer logs is pretty bad. Very bad to be fair. It means your computer is infected and have stolen all your saved passwords.

Reinstall your operating system completely. Take note of your accounts and change all their passwords. Start with your email address as its the most important one.

[-] kekmacska@lemmy.zip 1 points 2 months ago

No, it was steam that was breached. Haveibeenpwned notices you about major central data leaks. It is not an anti-malware

load more comments
this post was submitted on 14 Jan 2025
152 points (100.0% liked)

Privacy

36480 readers
252 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS