2

I received an email today from Etsy saying they are resetting my password(from the source it looks like a mass reset of all users), due to there being some sort of Linkedin breach, that compromised emails, and passwords.

Etsy says they themselves aren't compromised, but apparently you can use a linkedin account to access Etsy.

So I'm curious.

  1. How big of a deal was the Linkedin breach?? I'm assuming everything was protected so that our passwords were not plain text, but I guess it's a matter of time before they are cracked (I'm assuming LinkedIn uses very good security).

  2. From what I see they "Invalidated" passwords before 2012... but what about after?

  3. Did Etsy actually do a mass password reset, or is this a spam/phishing email trying to take advantage of what happened with Linkedin, or take advantage of us not knowing that Linkedin was/wasn't compromised?

  4. If both passwords were reset internally(Linkedin "Invalidated some passwords), is there any reason to reset the passwords if we don't need to use those services? I'm not sure how good their "random passwords" for resetting are, but if they are good enough can we just not change the passwords, or is it ALWAYS a best practice to change the passwords?

^ I'm just wondering if there might be greater risk (phishing attempt) if you do try to click those password reset links(since I'm assuming they aren't emailing us our passwords), and that those could be malicious? Again, assuming the fact that you do NOT use those accounts often. If you do use them often, or that we SHOULD reset the passwords again... what steps should we take then? Contact both companies to make sure it was a legit breach and that my email to Etsy was legit?

EDIT:

another question came to me..

Would it be wise for everyone to change their passwords across the board then? If the data has been cracked, then people should change their passwords (for those who were compromised back then, probably already changed their passwords I'm assuming though)?

  • 3
    In short, LinkedIn used weak hashing, and was hacked 4 years ago. Many of those hashes were likely cracked by now. – Alexander O'Mara Jun 22 '16 at 23:57
  • Ah, gotcha. So there wasn't a recent breach? I Googled "Linkedin breach": and there was a comment about it on one site, and there were talks about Linkedin and myspace hackers and such. So those who have had passwords before 2012 should change their passwords across the board then? – XaolingBao Jun 23 '16 at 1:36
  • 2
    General advice: Never click directly on the email links. Its better to go directly to the site and change your password there. It doesn't harm you to change your password even if the email is fake. – lepe Jun 23 '16 at 2:12
  • @lepe the issue with that is whenever you try to chagne your password on a site... You're most likely going to be given a reset link... – XaolingBao Jun 24 '16 at 9:24
  • 1
    @XaolingBao: If you receive a link, you can copy + paste and verify that its actually going to the site you expect. The problem is that many naive people just click on them without verifying the actual link, remember that this is possible: <a href="http://notgoogle.cu.aa">https://secure.google.com/login</a> (displays google url, but goes to other site). Many sites will send you a code (to copy+paste) along with the link, so its your choice. – lepe Jun 24 '16 at 9:45
5

The email is referring to a breach of the LinkedIn password database that happened back in 2012. This was one of several HUGE breaches that was discovered around the end of May 2016, all of which actually happened earlier.

Although we knew about the LinkedIn breach a few years ago, we thought it was only a case of "some passwords were stolen". 6 million account owners were apparently notified at the time.

Then somebody put the full dataset for sale on the darkweb in 2016. And we learned the true scope was "all the passwords got stolen".

After these breaches, there are now over 600 million valid username/password combinations for sale, for a few very popular sites including LinkedIn, MySpace, and Tumblr.

Knowing that the majority of Internet users re-use passwords, smart criminals bought up those stolen credentials and started trying to log into various other online services, including github, Twitter, Pinterest, Instagram, TeamViewer, GoToMyPC, and almost certainly others. So no, I doubt very much "you can use a LinkedIn account to access Etsy", however if you (like most people on the Internet) used the same password on Etsy as you used on LinkedIn, somebody probably used the password they stole from LinkedIn to try logging into your Etsy.

So: if you've EVER had a LinkedIn account, or a MySpace account, it's probably a good idea to change your password there. If you ever re-used that password anywhere else, change it there too. To be safest, you're right not to follow the link in the email. Go directly to each site, and change it there through the normal means, rather than following the email link.

While you're at it, consider getting a password manager like KeePass, 1Password, DashLane, LastPass, or similar; this will allow you to come up with a unique and strong password everywhere, without needing to remember all of them. Then when something like this inevitably happens again, you only need to change the one password that got breached.

If you're curious (or want to have a warning next time), take a minute to search for and/or register your email address over at Troy Hunt's haveibeenpwned service, which can tell you if your credentials were leaked in any of the fairly large collection of breaches he had access to.

0

If you use the same password for other websites it definitely leaves you vulnerable. I'm not sure if it's a phishing attempt, however if you've started to form a pattern for repetitive password use it may be the smartest move to change to something new.

protected by Community Jul 4 '16 at 14:18

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.