16

I have just received this email from AbeBooks.com:

Hello AbeBooks Customer,

This is an important message from AbeBooks.com.

As part of our routine security monitoring, we have learned that a list of email addresses and passwords were posted online this week.

While the list was not AbeBooks-related, we know that many people reuse their passwords on several websites. We believe your email address and password set was on the list posted online.

Therefore we have taken the precaution of disabling your password on your account. We apologize for any inconvenience this has caused but felt that it was necessary to help protect you and your AbeBooks account.

I don't care so much about my AbeBooks.com account as I barely use it. But, I am very worried to know that my email and password are published online. Although I tried to Google for my email and haven't found anything.

What should I do now? Should I change the passwords in all my 50+ accounts?

Improve this question
2
  • 1
    If possible you have to find that page. It's well worth to delete the accounts you don't use often, then change the passwords of the most used sites.
    – naiveai
    Sep 14, 2014 at 4:30
  • I don't consider myself paranoid, but whenever I come across a password dictionary, I grep through just to make sure none of my common ones are in there.
    – IQAndreas
    Sep 14, 2014 at 5:02

3 Answers 3

Reset to default
23

Probably the most comprehensive database of searchable compromised accounts is haveibeenpwned.com.

If you've reused the password in multiple places then yes you should assume that password has been compromised. I also recommend enabling two-factor authentication wherever possible as this will reduce the risk of one account being compromised leading to other accounts being compromised.

Improve this answer
1
  • 3
    Thanks! Through this site I've reached at another site: isleaked.com where I found that indeed my password has leaked, so I changed it immediately.
    – Erel Segal-Halevi
    Sep 14, 2014 at 6:19
3

The great news is that https://api.pwnedpasswords.com/range/ABCDE lets you achieve the goal of checking your password without exposing it to anyone.

How does it work?

https://haveibeenpwned.com/Passwords links to https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity, which describes how they offer "k-Anonymity".

Basically, instead of sending your actual password, you first generate a sha1 hash of your password and then send only the first 5 characters of that. The pwnedpasswords service will then respond with a list of hundreds of possible matches, and you then search from among those results (using the rest of the sha1 hash of your password) to see if any of those are really a match to the full hash of your password.

Using this approach, neither your password nor even the full sha1 hash of your password ever get sent across the internet to pwnedpasswords.

P.S. As an example, the sha1 hash of "P@ssw0rd" is 21BD12DC183F740EE76F27B78EB39C8AD972A757, and https://api.pwnedpasswords.com/range/21bd1 currently shows (when you search for the rest of the hash from among the results) that it has been found leaked 52579 times.

P.P.S. There are also tools built in to Windows and Mac for generating the sha1 hash of a password.

Improve this answer
9
  • I generally disagree with this answer. While you certainly shouldn't get into the habit of putting your password into any site that claims to be doing a security check for you, there are exceptions. In particular, the haveibeenpwned password checker does exactly what you suggest people do, but in a much less error-prone fashion. You can even verify that your password is not being sent by using your browsers network tools and a test password or two.
    – Conor Mancone
    Sep 24, 2019 at 14:35
  • It's also important to keep in mind that a password by itself is not dangerous. It is the combination of your email address and password that is dangerous. My password could be splashed across the internet and as long as it was in no way connected to me, I wouldn't be at all in danger. As a result, while it is important to not go and enter your login credentials in a random site, entering just a password is different, and doesn't necessarily require extreme alarm.
    – Conor Mancone
    Sep 24, 2019 at 14:37
  • @ConorMancone I see a huge percentage of people in the world being too lax with security and not even thinking about what app or what site they're providing their information to. I think telling less-security-conscious people "Well, this particular site haveibeenpwned seems fine to type information into because I used Inspect and typed a couple test passwords and saw that they were only transmitting truncated hashes" has multiple problems. A) It would require them to remember a list of which sites have been recommended as trustworthy.
    – Ryan
    Sep 24, 2019 at 14:48
  • 1
    And yet this is exactly why security is never an all-or-nothing game. "Don't ever put your password somewhere else - instead follow these complicated steps to check if your password is leaked" is an equally dangerous answer. It's dangerous because very few people can follow the steps you gave. As a result, if you tell them "It's only safe to do it this way!" most people will simply never check for password leaks, and therefore continue to use leaked passwords. Security is a balancing act because all security steps have a cost, and not everyone is willing or able to pay it.
    – Conor Mancone
    Sep 24, 2019 at 14:57
  • 1
    @Ryan While I personally will never enter my passwords into another site, it doesn't really matter for me because I'll have my password manager generate a secure password for each site anyway. This answer is fine for someone with technical knowledge, but I think the benefit of showing "[insert technically challenged relative here]" that their password is bad outweighs the risk, and even if "[non-technical person]" tried to use some example code to hash their password and make a request to the api, they'd now have to trust whoever wrote that code, so you're just moving the problem around.
    – AndrolGenhald
    Sep 24, 2019 at 19:21
1

Do you have the same password on all your 50+ accounts? If not I think you should not be worried. Change the password on your AbeBooks account and maybe the email addres you Googled and you will be fine.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .