I received an email today from Etsy saying they are resetting my password(from the source it looks like a mass reset of all users), due to there being some sort of Linkedin breach, that compromised emails, and passwords.
Etsy says they themselves aren't compromised, but apparently you can use a linkedin account to access Etsy.
So I'm curious.
How big of a deal was the Linkedin breach?? I'm assuming everything was protected so that our passwords were not plain text, but I guess it's a matter of time before they are cracked (I'm assuming LinkedIn uses very good security).
From what I see they "Invalidated" passwords before 2012... but what about after?
Did Etsy actually do a mass password reset, or is this a spam/phishing email trying to take advantage of what happened with Linkedin, or take advantage of us not knowing that Linkedin was/wasn't compromised?
If both passwords were reset internally(Linkedin "Invalidated some passwords), is there any reason to reset the passwords if we don't need to use those services? I'm not sure how good their "random passwords" for resetting are, but if they are good enough can we just not change the passwords, or is it ALWAYS a best practice to change the passwords?
^ I'm just wondering if there might be greater risk (phishing attempt) if you do try to click those password reset links(since I'm assuming they aren't emailing us our passwords), and that those could be malicious? Again, assuming the fact that you do NOT use those accounts often. If you do use them often, or that we SHOULD reset the passwords again... what steps should we take then? Contact both companies to make sure it was a legit breach and that my email to Etsy was legit?
EDIT:
another question came to me..
Would it be wise for everyone to change their passwords across the board then? If the data has been cracked, then people should change their passwords (for those who were compromised back then, probably already changed their passwords I'm assuming though)?
<a href="http://notgoogle.cu.aa">https://secure.google.com/login</a>
(displays google url, but goes to other site). Many sites will send you a code (to copy+paste) along with the link, so its your choice.