Let's equip our Legendary
Can websites log my passwords?
Let's assume the website did their hashing correctly. When you log into a website, they are able to take your plaintext password and compare it to the stored hash. If the passsword matches the stored hash in the database, it will allow you to authenticate. If not, it will inform you that your password is invalid.
Well, it so happens that anyone with a modicum of programming knowledge could log invalid passwords by adding a new line to an authentication method for any kind of website... even if it's a popular, open-source web portal, forum, or any kind of package. As long as the source can be modified, one can change anything they want, like so:
private void CheckPasswordBeforeHackingMyAOL-CD(string input, string username)
if (IsValid(input) && IsValid(username) && Bcrypt.TestHash(input, Database.GetHashForUser(username))
In fact, a programmer could do this before hashing for everything having to do with passwords. There's nothing stopping anyone from doing it.
Here are some questions to consider:
- Do you care about the integrity of either account?
- Is the same email in use in both accounts?
- Do you use the same password for both the email and website(s) in question (I hope not)?
If yes to 1-3, I would recommend changing your password. Unless you just don't care.
Now that we've shown this is possible on every front, should you be afraid of such an attack? I wouldn't worry about it. If you are worried, then you should probably use something like KeePass to manage website credentials so you legitimately don't have to worry.