Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My skype password was recently changed. I've changed it back and found it in the internet on hacker's site. My password is pc-generated, like as2fZ12v. How did they manage to hack it, if I've never written it anywhere?

share|improve this question

closed as too broad by Adnan, Xander, TildalWave, AviD Mar 2 at 10:56

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

    
When you "found it in the internet", was it the old or new password? How did you find it - did you enter the password into a search engine? Why do you think that the website it was on belonged to the same attacker that compromised it? –  scuzzy-delta Mar 1 at 13:26
    
You say 'hackers' and 'internet' -- so what exactly makes you think they would need to see a written down password? Why could they not steal the password with a keylogger? Most compromised passwords were probably never written down. –  David Houde Mar 1 at 13:31
    
More information on the hacker's site you found it can be useful to determine how it has been compromised. –  ack__ Mar 1 at 14:00

1 Answer 1

up vote 3 down vote accepted

Although Skype uses robust mechanism and cryptography to authenticate a user, a password can be compromised in many ways from many different points. For example:

  • From your endpoint, e.g. malware stealing your password, using a keylogger, etc.
  • From external parties, e.g. password reused on another system/application which has been hacked, password manager being compromised
  • Guessed by an attacker, e.g. brute-forcing, "lost my password" feature revealing the password in clear-text

In fact, there are so many different ways to compromise your password that one can not answer your question precisely.

Most of the time, attackers are able to obtain credentials on robust applications that they cannot compromise directly (e.g. Skype, Facebook, Google) thanks to password being reused on different applications and systems with weaker security settings.

For instance, when a big username & passwords list is leaked on internet, hackers immediately check for those credentials on other applications.

You can also check online tools that verify if your username / email has been compromised somewhere, for example: Have I been pwned

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.