69

I recently received an email from a well-known company stating that the password I use is weak and can be easily guessed.

The email seems legit with no attempt to steal information, they only say "log into your account and go to account->account details to change your password" with no link that they can fake or anything.

  • How do they know that my password is weak?
  • Are they not supposed to not know my password because it is encoded when they save it?
  • Should I be concerned about the way they handle my information?

The company the email is from is a pretty major and well-known company. I have not used their service or logged in for a few months.

Improve this question
4
  • 51
    Github^H^H^H^H^H^H A well known company is known to use the PwnedPasswords API from HaveIBeenPwned, and has been sending out legitimate emails over the past several weeks. They check your password when you log in, do not store it in plaintext, and flag your account until you change your password. Use a password manager and select a random, unique password for each site that you're able to.
    – Ghedipunk
    Oct 23, 2019 at 19:07
  • 1
    Reason for concern? Only if it is from your own account.
    – Peter - Reinstate Monica
    Oct 24, 2019 at 13:54
  • 15
    What does "Github^H^H^H^H^H^H" mean?
    – Nathan Hinchey
    Oct 24, 2019 at 16:58
  • 37
    @NathanHinchey ^H stands for the backspace character, so the comment is supposed to look as if Ghedipunk first wrote "Github", then decided to delete the name and write "a well known company" instead, as in "I don't want to tell you who did it, but .... ah, who cares, I'll tell you anyway"
    – Hagen von Eitzen
    Oct 24, 2019 at 18:06

3 Answers 3

Reset to default
147

They do not need to be able to read your password to test it against known weak and guessable passwords. All they need to do is to try all the guessable passwords against your password. It can be properly hashed and salted, as they are supposed to do.

They can do this quickly because they have legitimate access to the password hashes and can simply have tests running in the background. There are even services out there for companies to use that hold leaked passwords from other known leaked password databases.

Of course, once they test it, then they might know what your password is (depending on how they tested it), but then, so can attackers using the same method.

So, there is no indication of improper password handling. No reason for concern. But, if their automated testing found it, then your password is probably very guessable and should be changed as soon as possible.

Improve this answer
16
  • 3
    just to make clear that they do not even need to attempt to login with these weak passwords on your account: they can simply generate the hashes of all "weak" passwords and send an email to anyone that has a matching hash in the db.
    – Frank Hopkins
    Oct 23, 2019 at 22:19
  • 111
    "Your password is easy to crack" "How do you know?" "Well, we cracked it."
    – corsiKa
    Oct 24, 2019 at 1:02
  • 5
    @FrankHopkins That only works for unsalted hashes, which would still be concerning since it means that they don't follow basic security standards.
    – user185186
    Oct 24, 2019 at 5:17
  • 5
    @SethR Rotating your password periodically is bad advice. It does not strengthen security, and may weaken it. Making sure your password is strong is of course, excellent advice.
    – Martin Bonner supports Monica
    Oct 24, 2019 at 10:26
  • 3
    @MartinBonner unless you are unaware that it has been compromised. There is a reason why products like CyberArk change passwords once used. In my environment, if passwords never expired, I could have people with very sensitive access to data with passwords that exist for 15 years. The threats against those accounts are inherently stealthy and quiet and have a desire to maintain access for as long as possible. I have to insist on periodic changes to mitigate that threat that will never expose themselves.
    – schroeder ♦
    Oct 24, 2019 at 12:51
14

The email may be totally legit, you don't actually need to know the password in plaintext to know that it has been part of a data breach, just that the hash of your password is in a data breach, that's how the API of haveibeenpwned works for example.

Furthermore if your password is weak you should probably change it :)

Improve this answer
5
  • 2
    This is a summary of the previous answer
    – tungsten
    Oct 23, 2019 at 10:49
  • 14
    I know mate, I must have published it at the same minute :)
    – kudrom
    Oct 23, 2019 at 16:48
  • 10
    As worded, this is actually not the same as the other answer. It implies that it is the hash of the password which is checked against leaked hashes (which does not make the password weak per se, just weak because the hash was leaked), which would imply that either both the leak and the present system do not salt hashes, or that the leak comes from the present system! If you have a salted hash, you cannot check it against other hashes of the same password (salted or otherwise). You cannot use the haveibeenpwned API with a properly salted hash, you need to know the cleartext.
    – jcaron
    Oct 24, 2019 at 7:01
  • 5
    @jcaron which would make this answer wrong, assuming best practices.
    – schroeder ♦
    Oct 24, 2019 at 15:11
  • @schroeder which makes your comment "wrong", assuming pedantry. ie This answer usefully addresses a possible aspect of the issue so, while not as correct as some, is useful enough to leave alone. | The same may be said about my comment :-).
    – Russell McMahon
    Oct 26, 2019 at 0:45
0

The other answers are fine, but there's an at least theoretical second possibility which you touched on in your question and which bears discussing. (This is totally obvious to the security paranoids out there, but maybe not everyone else.)

If the "you have a weak password" message did not come from the site it claims to, and if the sender of that message -- who is actually an outside attacker -- has a way to eavesdrop on, and is lurking there waiting for you to, log in and reset your password as requested, then boom, he's got his hands on your new, "more secure" password (even though he may not have had any idea what your old password was, or how weak or string it was).

How could an attacker eavesdrop on your password reset session? * compromised the part of the site that accepts password change requests * sniffing your Internet connection somehow * gave you a helpful link in the email which points at a different site that mimics the real site

@darnok mentioned being careful about exactly the right two things:

  • verified that "the email seems legit"
  • noted that the email did not have a convenient link, that the suggested action was to "log into your account and go to account->account details to change your password"

But, these days, if you get such an email, I'd say you're right to be concerned. If you were the victim of a well-resourced attempt to steal your password, this is exactly what it might look like.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .