It seems that by now, almost all social media platforms have been breached in some way. Tumblr recently revealed it found data from a 2013 breach for sale on the darknet marketplace. The number of unique email addresses and passwords was nearly 65.5 million according to independent analysis done by Troy Hunt, a security researcher. This makes it one of the top largest breaches to date; ranking right up there with LinkedIn at 164 million and MySpace, which was recently estimated to be in the 360 million range.
This is yet another example of why using unique passwords for your accounts is essential and changing them often is also wise. Try to avoid writing them down, but there are a couple of tricks for creating unique ones.
Jim Stickley of Stickley on Security recommends creating one core password of at least six characters. Then add two characters from the website on which you have your account to create a minimum of eight. Then it is highly unlikely you will have the same password for any two sites. For example, you core password could be “XU#$p4” and you visit a site that starts with “co.” Your password would become “XU#$p4co.” Another site may start with “re,” so your password for that site would be XU#$p4re” and so on.
Another way is to combine two words that normally would not be found together. This would make it more difficult to crack using password cracking technologies.
If you have to write them down, it is understandable considering how many we have these days. Just make sure to keep the list separate from any internet-connected device and out of plain sight. Try to use clues to jog your memory as opposed to writing down the full passwords.
Fortunately, the passwords in the Tumblr case were hashed. This means the technology the company used turned the passwords from plain text to a different string of digits. In addition, they “salted” them before hashing them, which means they added some random bytes to the ends of them. Taking these steps makes it more difficult to crack and therefore the buyer ended up with only email addresses and not easily usable passwords. However, keep in mind that email addresses are valuable for phishing, which remains the top way malware ends up on computers and mobile devices.
Even possibly more interesting about this story is that the data from this one, LinkedIn, and MySpace were all from breaches that occurred quite some time in the past. The data was out of public sight until recently. This means that if your data is accessed but there are no signs of misuse right away, it may come up for sale down the road. So stay diligent by frequently changing passwords and monitoring credit reports and payment card statements.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
