Home » Forum » Story Discussion and Feedback

Forum: Story Discussion and Feedback

SOL, SciFi & FineStories PW's

NC-Retired 🚫

Hmmm... no where else to post this query.

Got a notification from Google that my PWs have been compromised.

I just looked at all three World Literature sites and the passwords are not the exact same, but similar. They are simple and silly.

But places that need stronger passwords, email, bank and other places where I use CCs to transact business have stronger PWs.

I'm curious whether the WLC PWs, simple and silly and used no where else, really need changing if they have in fact been compromised?

Lazeez and others, please give advice. Change or no?

Thanks

Replies: jimq2 Dominions Son Grant Michael Loucks awnlee jawking samt26 Lazeez Jiddan (Webmaster) NC-Retired Grey Wolf

jimq2 🚫

@NC-Retired

Funny, but I got the same message "supposedly" from Google. Since they don't connect with any of my active accounts, I ignored it. Google has nothing to do with my personal account passwords, except for a backup gmail account. Unless you use a google password manager. Also, it arrived in my junk mail folder.

I wonder how many got the same message.

Dominions Son 🚫

@NC-Retired

I would carefully double check the sender on that email. It's probably a phishing attempt.

I've been getting repeated emails lately that my Amazon Prime account has been suspended. I've never had a Prime account.

Grant 🚫
Updated:

@NC-Retired

If you are using Google Chrome and it's Google Password Manager, and you have Password checkup enabled or in your Google account and/or you have Check Passwords enabled in the Password checkup section then the message would be legitimate.
Otherwise, it's not.

And in any case- do not use any links supplied through phone text or email notifications to make the changes- go to the website itself, or to the settings on your Chrome browser.

Change unsafe passwords in your Google Account
You can find out if passwords in your Google Account may have been exposed, are weak, or are used in multiple accounts. Then, you can change any unsafe passwords to keep your accounts more secure.

https://support.google.com/accounts/answer/9457609?hl=en#:~:text=Google%20can%20notify%20you%20when,for%20up%20to%2048%20hours.

Michael Loucks 🚫

@NC-Retired

Lazeez and others, please give advice. Change or no?

IMHO, nobody should be using simple passwords in this day and age. Get a (free, open source) password manager (or use one of the built-in ones) and use long, complex passwords. You should also use 2FA where available, and do it via an app on a device (TOPT), not via SMS (which is clear text and not secure) or email (which is stored in plaintext in most cases, and is not secure).

Your minimum password length should be 14 to 18 characters, upper, lower, digits, symbols. I typically go with 22-28, unless a site limits me to fewer.

And be sure your passphrase for your password vault should be long and complex (it's OK to enable biometrics to make this easier).

Replies: NC-Retired samt26

NC-Retired 🚫

@Michael Loucks

As mentioned... 'important' stuff have complicated passwords, usually random generated.

And where appropriate, 2FA is implemented.

Replies: Grey Wolf Michael Loucks

Grey Wolf 🚫

@NC-Retired

This is likely a case where 'important' is in the eye of the beholder.

Personally, every single new password I generate is generated by a random generator and stored in a password manager. They all have complicated passwords.

But that doesn't mean I've gone back and reset every 'classic' password I generated before the rise of password managers. There is some level of triage there.

For a reader, SoL may well be 'unimportant' (which is, I think, what you were asking). Ask yourself what the loss to you is if someone 1) figures out the password and 2) logs in with the intent to do as much damage to you as possible.

For an author, I suspect SoL is 'important'. Someone gaining access to my author account could create a ton of work for me in fixing things and could potentially delete things which cannot be recreated (e.g. the comment section of my most recent works).

For every site, that's basically the math: if someone malicious were able to log in as you, what is the loss to you if they do so? If it's low, don't worry. If it's high, change your password ASAP.

Replies: samt26

samt26 🚫

@Grey Wolf

This other issues are what info about you do they get when they log in. Email? Physical address? CC? That we like stories?? Will the passwords work at other story websites? Etc, Etc

Michael Loucks 🚫

@NC-Retired

As mentioned... 'important' stuff have complicated passwords, usually random generated.

And where appropriate, 2FA is implemented.

Unimportant stuff might leak information that could be used against you. There is, IMHO, no 'unimportant' stuff with regard to account security. Even throwaway accounts get strong passwords.

Replies: awnlee jawking

awnlee jawking 🚫

@Michael Loucks

I have had accounts hacked three times in my lifetime. None of those cases would have been averted by passwords of any length and complexity. Two were due to weaknesses in Yahoo Mail and Hotmail allowing entry without passwords, for the third the perps got into an on-line shopping site which had poor security and downloaded all the customers' details.

I'm not convinced the danger of using memorable passwords is as great as is claimed by some.

AJ

Replies: Michael Loucks Lazeez Jiddan (Webmaster)

Michael Loucks 🚫

@awnlee jawking

I'm not convinced the danger of using memorable passwords is as great as is claimed by some.

Credential stuffing, rainbow tables, brute force, and other methods are used regularly to gain access to accounts.

Lazeez Jiddan (Webmaster)

@awnlee jawking

I'm not convinced the danger of using memorable passwords is as great as is claimed by some.

Depends. Some people still use 'mypassword', 'imgod', 'Jesus' or some similar stuff. It's memorable and very easy to guess.

I believe in pass phrases, which can be super hard to crack, but are usually very limited by current password policies.

I use a combo phrase. I'm lebanese, so I use lebanese phrases combined with the related site clue, and the clues are spread out.

For example in lebanese, 'he went to school' is 'ra7 3al madraseh'.

You can combine that with something specific about the site. So for storiesonline, you can use the first 6 letters of the site's name as glue for the phrase, so the password becomes 'ra7sto3alrieMadraseh', for gmail it becomes 'ra7gma3alilMadraseh'. To crack such a system, a hacker would need to have more than one of your passwords and tries to figure it out.

If you lose your password manager's database, you can still log in to any website as long as you remember the pattern you created.

The problem that I usually have using such a system is that many password systems have such low character limit as to make it hard to use a long enough phrase for my taste. And they force you to change your password regularly, which messes with something like that.

Replies: Michael Loucks Charro6

Michael Loucks 🚫
Updated:

@Lazeez Jiddan (Webmaster)

And they force you to change your password regularly, which messes with something like that.

Forced password changes are actually bad for security. Most security professionals now reject that advice. Sadly, that practice is so ingrained that it lives on despite being bad (which I suspect you know).

It's similar to SMS or email 2FA. Those are both weak compared to TOTP using an authenticator app (never use the password manager for TOPT as that weakens it by keeping both factors stored together)

Replies: jimq2 Grey Wolf

jimq2 🚫

@Michael Loucks

Years ago I worked for a large US company. Every other month we were required to change passwords and IT almost got shut down for a week as they were bombarded with reset requests because fully a third of the staff couldn't remember their new passwords. It didn't help that we needed 3 distinct passwords: Login; Email; and Software. They talked about making it monthly, and IT threatened to quit. They made it quarterly, and I understand that it is now every 6 months for Login and Email and quarterly for software.

Part of the discussion was that the more complicated the password requirement, and the more frequent the change, the greater the likelihood that non-computer techs would simply write it down and keep it in their desk drawer.

Replies: Dinsdale

Dinsdale 🚫

@jimq2

When I was first forced to change my passwords at work every 6 (?) weeks, my initial system was along the lines of March2024, April2024 (minimum 7 chars, uppercase and lowercase and numerics) and so on.
After a couple of months of that I came up with a better idea.

Grey Wolf 🚫

@Michael Loucks

I'm hoping that the 2024 NIST guideline update, which recommends that passwords not expire unless compromised, will lead to a widespread rethinking of that policy. Yes, that might be wishful thinking.

Charro6 🚫

@Lazeez Jiddan (Webmaster)

For my job I need two different PW to get any type of work done.

The company forces me to change one every three months

The other PW I am forced to change every six months.

It is funny that the system somehow saves the previous PW because I cannot use the same password in the past 2 years.

I wonder how safe they really are?

samt26 🚫

@Michael Loucks

Concur 100%

awnlee jawking 🚫

@NC-Retired

Got a notification from Google that my PWs have been compromised.

How did you get a notification from Google? Was it via e-mail? Was a pop-up when you were using the browser?

I'm not an expert but it smells like a scam.

AJ

Replies: NC-Retired

NC-Retired 🚫

@awnlee jawking

How did you get a notification from Google? Was it via e-mail? Was a pop-up when you were using the browser?

I have a "large screen size" Android phone that uses Chrome for the browser.

I often sit in my recliner reading on here or SciFi or FS. I look at weather and news and some political sites.

Never do I use the phone browser for anything financial or critical to my well being.

I was using yewtood a couple nights ago and the message 'popped up' at the top of the screen and when I opened it it said my FS password was compromised in a data breech and also singled out SOL and SciFi as vulnerable.

Spam? Perhaps. But if others have seen similar pop ups then what? Dunno.

Replies: Dominions Son

Dominions Son 🚫
Updated:

@NC-Retired

Spam? Perhaps. But if others have seen similar pop ups then what? Dunno.

I get popups for phony anti-virus claiming my system has been scanned and threats found. There are all kinds of malicious ads you can run into.

samt26 🚫

@NC-Retired

Change em'. From bitter experience, change em'. If they get the passwords they will probably get your email. More data ties to you the more vulnerable you are.

Lazeez Jiddan (Webmaster)

@NC-Retired

I just looked at all three World Literature sites and the passwords are not the exact same, but similar. They are simple and silly.

You have a separate account for each site?

Replies: NC-Retired

NC-Retired 🚫

@Lazeez Jiddan (Webmaster)

No.

Replies: Lazeez Jiddan (Webmaster)

Lazeez Jiddan (Webmaster)

@NC-Retired

if you have one account, then you have one password.

If your password manager has more passwords than one, maybe you're still saving the old per-site passwords.

Now all you need is the one password at login.wlpc.com. Any site-specific entry is now useless and should be deleted.

NC-Retired 🚫

@NC-Retired

Changed.

Hope this conversation helps other folks keep themselves secure also.

Thanks all that replied.

Grey Wolf 🚫
Updated:

@NC-Retired

Amusingly (and annoyingly), I just ran into a site where it's impossible to change a insecure password. The site's current password policy requires 8 characters or more. The old, insecure password is 6 characters. The 8 character length is enforced in the password change form JavaScript; thus, the existing password is refused. It is not enforced in a login screen.

Turning off JavaScript does not help, as the site will immediately refuse to do anything at all until it's turned back on. So far, no one that's seen this problem has been able to point at how one might use the debugger to work around it.

Reply to topic

Forum: Story Discussion and Feedback

SOL, SciFi & FineStories PW's

WARNING! ADULT CONTENT...