1

I just tried logging into Glassdoor and recieved this message:

We have temporarily disabled your account. We have identified that your password matches one you have used on an unrelated website that has experienced a security breach.

I checked here and the only breach I was a part of was the "Hack Forums" breach—a forum where my password was totally different than the ones I regularly use because... it's hack forums, and I didn't trust it.

Is something fishy going on here? How would Glassdoor even know this?

4
  • 1
    contact Glassdoor support
    – schroeder
    Oct 23, 2017 at 14:08
  • when did you log into Glassdoor last? Has it been a year?
    – schroeder
    Oct 23, 2017 at 14:13
  • They have been issuing this notice for over a year. There are lots of ways how they might be able to compare your password to other services, but from a quick google for this message, it might be misleading and not be about your password at all.
    – schroeder
    Oct 23, 2017 at 14:15
  • there's public lists of cracked passwords, it's not hard to search the list...
    – dandavis
    Oct 23, 2017 at 23:10

2 Answers 2

4

I see three possibilities:

  • Glassdoor knows about a breach that haveibeenpwned.com doesn't know about.
  • Glassdoor isn't telling the truth. Perhaps they have only found your email in a breach, and not your password. Could be an honest mistake, or perhaps they want it to sound more serious and urgent to justify the extra work they force you to do.
  • Your memory is wrong, and you did in fact use the same password at some point in time (not necessarily now).

Only way to find out which one is to ask Glassdoor.

2

Glassdoor is probably proactively doing exactly what the bad guys do, to pre-emptively catch password reuse and protect your account.

Other compromised sites' passwords are sometimes publicly leaked (either in a plaintext form, or in a form that is weakly stored and easily cracked). It looks like Glassdoor has examined such leaks, and correlated at least one of them with your account (probably by searching for your email address in those leaks, and then checking to see if the password in that leak matches your Glassdoor password).

Usually, you could use a site like Have I Been Pwned to check which leaks (if any) have contained the email address that you use with Glassdoor. But it sounds like that's not the case here, so Glassdoor may have acquired a leak that's not yet on HIBP.

Also, since HIBP doesn't provide the passwords itself, the only way that Glassdoor could do this is if they obtained the public leaks directly themselves, and performed the correlation. As Anders said, it's possible that they acquired it directly or from another source.

At face value, Glassdoor is doing a good thing here. Bad actors know that users often share the same password across sites, so they download the public leak, and then try those email/password combinations on other common sites. Glassdoor is proactively countering that. This is good for user security - and a good sign that they know what they're doing.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .