Timeline for Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?
Current License: CC BY-SA 4.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 4, 2019 at 16:33 | comment | added | Tom | Yes, but it borders on paranoia to state that your password might be compromised right now... no, now... maybe now? how about right now? That's not a proper approach to assess the risk. | |
| Feb 4, 2019 at 15:57 | comment | added | Frank Hopkins | @Tom his point is likely, that you can never be totally sure your machine/password has not been hacked. Your password might become compromised any minute. So the security cost of not changing your password is never 0. Not changing a password (or rarely) may still be a valid strategy, but the cost is still unknown even if it is your own machine. There is only "factual data" that indicates "you need to change your password now", but none that clearly indicates "you dond't need to change your password". | |
| Jan 22, 2019 at 18:50 | comment | added | Tom | Absolutely. You can get positive evidence from it, but not negative. The whole problem is that 3rd party websites can be compromised and you'll never know because they hush it up. That is why I have different password policies for my own sites and 3rd party sites. | |
| Jan 22, 2019 at 10:21 | comment | added | Tom K. | Isn't the the point though, that neither you nor Troy Hunt does know about all security breaches? You speak about "actual evidence" but Hunt himself quotes the famous "Absence of evidence is not evidence of absence" in his FAQ and goes on with "just because your email address wasn't found here doesn't mean that is hasn't been compromised in another breach." | |
| Jan 22, 2019 at 9:37 | history | answered | Tom | CC BY-SA 4.0 |