21/10/2022
Data breaches and leaks are heinous acts, which people must be, concerned with and armed with knowledge to act judiciously, when they happen.
The nature of these things can be critical, from online accounts and their passwords, to credit card information and personally identifiable information (PII) which would include but not be limited to: your name, physical home and work addresses, email address(es), work history, telephone number, gender and even copies of sensitive documents like passports, drivers permits, etc.
DATA LEAKS ARE SOURCES OF INFORMATION FOR IDENTITY THEFT!
Try to understand that I am not trying to give cause to panic but informing you, dear reader, on the nature of some nefarious goings on, so you will be prepared to take prudent courses of action.
My contribution will not address what to do in the event of the disclosure of you PII. That will be tackled at another time. My discussion today seeks to impact those who believe that their online accounts are impacted either by suspicious activity or exposed in a data breach. If there is a possibility that your passwords were exposed but your password practices are very good- where you enable two factor authentication (2FA) for your accounts, you inherently mitigate potential damage. 2FA implements a second layer of security on your account, so if any credentials associated with that account have been leaked, any attempts at unauthorised access to that account will be unsuccessful, as attackers will not have physical access to the authentication device, such as, your phone or hardware security keys.
However, whether you use two factor authentication or not, if your online account details have been compromised, CHANGE YOUR PASSWORD IMMEDIATELY!! If you don’t have 2FA turned on and it’s possible for you to add your phone number to the account, do so and turn on two factor authentication. Barring that, you can use USB securities. Some of them also use near field communication (NFC).
As a user of the Macintosh platform, I’ve really come to appreciate Safari. The web browser’s built in and third party developed security features are robust, improved upon with every iteration, with more added constantly. One such notable area, is in its Passwords manager. I never paid for a 3rd party app to manage my passwords on my desktop because I make use of Apple’s Keychain and its cloud syncing. I bought 1 Password 7 almost a decade ago this December 2022, for iOS, to store and have immediate access to other secure information I could store in customisable fields. I won’t be upgrading to 1 Password 8 mainly because Keychain does mostly what 1Password 8 does but also without a subscription premium. Eventually, Apple brought, Compromised Password Detection, in macOS’ Safari and in, Settings> Passwords, on IOS and iPadOS. I honestly cannot remember when it was introduced because it is a feature I never used. Whenever I read about data breaches, I just went directly to the affected websites and changed my password there. I still do.
Today when I fired up Safari, I was greeted with this notification: “Compromised Password. The password for your "google.com" account has appeared in a data leak, putting your account at high risk of compromise. Safari can help vou resecure vour account.” I immediately ignored Apple’s incorrect spelling of, ‘rescue,’ went to my Google Account page and did the deed.
I impress upon you with urgency, visit https://haveibeenpwned.com and check your email address{es} to see if they have been breached.
Please understand that by simply checking to see if your online account has been compromised and then changing your password will not change the results of the compromise check. Lost? Let me break it down for you: If you enter your email address into the, Have I Been Pwned website and you get a result confirming that your account is pwned (compromised) and show you how many data breaches your credentials are in, go and change your password. Immediately. After you change your account’s password ond you return to https://haveibeenpwned.com and enter your email address, the results will not change. It will still show that your account is pwned or compromised. Why?
“But Kofi, I just change my password. What foolishness is this?! What going on here?”
It’s simple really. The, Have I Been Pwned website does not know that you changed your password. All it can see is that your email address and its old credentials were exposed in a breach. You, changing your password or updating it, does not magically remove your email address and the old password from the breach. But you know what will happen if someone get’s their hands on that data that was leaked? When they try to use the old password and email address to login, they will be unsuccessful and your account will be safe.
DO NOT EVER CLICK ON LINKS IN EMAILS INSTRUCTING YOU TO RESET YOUR PASSWORD. This is known as phishing and I will discuss that in another informative post. Always open your browser and enter the address or URL (uniform resource locator) of the website. Login with your credential and change your password there.
Be safe.
