Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
A while ago, I found a website that said that it will pay up to 100$ an hour just to watch ads.
So, I thought what's the harm, and I created an account using a fake Facebook account (with my real name). My problem is that I entered a password that I use everywhere:
Am I in danger?
Because something is probably wrong with that website and I do not trust it.
You should change the password at all the places where you have used it.
Some Additional tips:
That is a lot of money just to watch ads, which is a red flag. The old adage comes to mind, "if it sounds too good to be true, it probably is".
Whether you are in danger or not, depends on a number of factors. A password alone isn't usually enough to do any harm (that doesn't mean you should reuse it).
Identity thieves compile a range of personally identifiable information (PII) and unique details on their target in order to be the most effective:
- Is your name unique?
- Having your name may not be enough for the scam site to achieve anything. John Smith would be less of a target than John Marshallburger, if all the information they have is a name and password.
- Does your password contain sensitive information, such as your birthday, social security number, spouse's name, etc?
- Did you provide any other information on the fake account you created, such as birthday, home address, social media accounts you have?
- If there were any security questions, did you provide real information?
- Did you click on any links from emails they sent you?
- Did you post a picture of yourself?
- What email address did you use?
It seems that this "scam" site that you signed up for has more to gain by having you read their emails or download applications, than just having 2 pieces of information from you. By reflecting on all the information you provided, and the actions you have taken since signing up for this possible scam site, you can figure out how at risk you are.
Take swift action to resolve your situation with the tips already suggested by others (using multi-factor authentication and a password manager). If you clicked on links from emails, run a virus scan to see if anything has been compromised on your system. I would also recommend checking to see if any of your accounts have been compromised at https://haveibeenpwned.com/. With enough information about you, an identity thief or hacker can create a profile of who you are and do serious damage.
Are you in danger? No one can really answer that, but take immediate action and develop a healthy level of paranoia which will help you in being more security conscious.
Change the password everywhere you still use it.
Make yourself a base password, but do not use it on all site.
Use variations instead, which can be site-relevant.
For example: if your chosen password is "MyPassword", for social media you can use a derivation like "MyPasswordSocialM" and for e-mail something like "MyPasswordMailA".
If you have a logic behind the naming you can't forget them and the others don't get compromised if one of them is found.
