I have just received an email from what seems to be Spotify (signed by spotify.com), where they suggest my password has been leaked.
This brings up two questions:
- How did they know I used the same password for both services, if the passwords were properly hashed and salted? Does this imply they are improperly storing the password?
- Is it possible to find out which service was compromised so I can stop using it/change the password for other services which may have used a similar password*?
The relevant part of the email is shown below
Hi Spotify User
To protect your Spotify account, we've reset your password. This is because we believe it may have been compromised during a leak on another service with which you use the same password.
Don't worry! This is purely a preventative security measure. Nobody has accessed your Spotify account, and your data is secure.
*I know the standard procedure for any password leak is to change every password for everything ever... but I'm only human (and a lazy one too)
For the sake of completeness, I contacted Spotify and they responded with:
Unfortunately, we can’t provide any further information about the status of your details on other services.