I apologize in advanced if I am misusing vocabulary, as I'm no security expert.

If you've been compromised (mostly regarding web accounts like e-mail, FB, etc.) once, are you more likely to be compromised again?

I can imagine that a hacker might have constant access to some piece of a table in the database where your account info is stored. Then, even if you change your password, he will know the new one and be able to compromise your account again.

Is this possible?

  • If the compromise means the security of the services the user uses is weak, then maybe. But what you are really asking is about the services, not the user. – schroeder Feb 12 '17 at 21:51

No. At least not for the reason you state.

You're confusing a single compromised user account, e.g. because someone figured out your password, with a compromised application platform. If I get access to your facebook account, that doesn't mean that I get access to the underlying machinery. And if I did get access to facebook's innards, it wouldn't just be a problem for you, but likely for every facebook customer. So while its true that with such access, I could keep compromising your privacy etc, that would also apply to lots of others, so you wouldn't technically be more likely than anyone else to be compromised, and being compromised yourself wouldn't have anything to do with an individual breach of your account.

Of course, if you used the same password on every online service and I found out what it was, then I could compromise every one of your accounts. But I assume that's not what you meant.

Also, if I compromised your mail account without you noticing, I could get continuous access to most your online accounts, even if you changed your passwords on them, because I could use their password reset functionality thanks to the access I had to your mails. But you'd notice sooner or later, because I'd need to change the passwords in order to gain access, so you'd keep wondering why your passwords didn't work.

  • +1 -- I wasn't specific about whether its just me or a group, so I wouldn't say I was confused. :) Regardless, your answer was satisfactory. Thanks! – Fine Man Feb 12 '17 at 22:03
  • But see, if you're talking about being compromised multiple times, that implies that the security breach is fixed, and then, because you were compromised in the past, an attacker could compromise you again with less effort. And that's not the case, because your database table access example implies a platform breach, but once that was fixed, you wouldn't be in any greater danger than before the breach. The big exception is that if the attacker can steal private information (such as a password or answer to a security question) and you don't change it, you'll be susceptible. – Out of Band Feb 12 '17 at 22:13
  • @SirJony: Hmm, thinking about it some more, the stolen private info, like cc number, social security number, date of birth etc might be used against you in social engineering setups that attack completley unrelated services, so depending on how you look at it, the answer to your question might be yes, not no. – Out of Band Feb 12 '17 at 22:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.