I'm told to change my password.
Why?
Hi, everyone.
Leo Notenboom here for askleo.com. Here's the question I got.
Should I be worried if I'm told I should change my password by a device or service?
They said my password is compromised and was in a data leak.
Let me put it this way.
I want you to go change that password
right now, if you haven't already, then come back,
watch the rest of the video, or read the article, and we'll understand why.
So now that you've done that, now that you've changed your password,
there are two different scenarios that could be at play here.
The first one is very serious.
The second one is still serious, just not as.
But there's also this third.
I don't even want to call it a scenario.
The third of two scenarios, right?
That is one of those more or less safety nets that if all else fails.
Think about this.
So number one on our list is what I call a direct compromise.
The service that notified you has been
compromised, their data has been stolen, and your information was in it.
Even worse,
based on what you've described, your actual password was somehow compromised.
Whether it was stored in plain text or compromised some other way doesn't matter.
Hackers now have your user ID and your password.
That's bad. And that's why I say you should
immediately go change your password, because that's exactly what the hackers
have access to your account on that service.
Now, it's important that you do this by going to the service yourself.
In other words, don't click on the link in the email that the service sent you.
We'll talk about exactly why in a moment.
But the important thing is that if,
for example, PayPal, I'll use them as an example.
If PayPal tells you that your password has
been compromised, do not click the link in the email.
Instead, go to Paypal.com yourself and then change your password.
The second scenario is what I refer to as an indirect compromise.
And this is a little bit more difficult for folks to understand.
But it is also very important and that's this
a service might report that your password has been discovered in a breach.
Now, the service that's reporting it might not be the one that actually got breached.
In fact, it might be your security
software or your password manager that's telling you, hey, I just noticed that this
password here, it's in this list of known passwords.
You should change it.
Here's the catch.
The account that was originally breached
and caused that password to be exposed might not even be you.
In fact, I'll go so far as to say it probably wasn't.
Instead, it's a case where someone, somewhere with some account at some
service happened to use the same password you do.
And because their account got breached
and their password got exposed, well, your password got exposed.
Now, you're right, in that no, they didn't expose your account.
They don't even know where you're using that password.
It doesn't matter.
It really doesn't matter.
If you're told that your password has been
exposed, you should stop using that password
wherever it is you happen to be using that password.
The reason is very simple.
What hackers do is they will take this
list of accumulated passwords that they've discovered at various accounts and various
breaches over the years and they will use that as their database of passwords to try
as they try to break into your account as they try to break into my account.
And if your password happens to be one
of the passwords that was exposed, Even through no fault of your own,
the hackers may be able to get in because if you're using that password and they
happen to try that password against your account, therein
now, I mentioned earlier that you should not click on the link in the email.
That's kind of another scenario that is different.
All it really is is phishing.
Hackers will often attempt to scare you into doing something you shouldn't.
They will tell you that, hey, your account has been compromised.
Your password is now known.
You should go change your password.
Here's the link.
If you click on the link in this phishing
email, you may land on a page that looks very much like the account page where you
need to log in to whatever service this happens to be.
Unfortunately, it's fake.
And if in fact you do try to sign in,
what you've done is given the hacker your account ID and password.
Your account had never been hacked at all.
Your password had never been exposed.
But in response to this phishing attempt,
you just gave them the information and now your account has been hacked.
So don't click the links in the email,
especially for these kind of notifications.
Again, go directly to the service and change the account password yourself
by whatever mechanisms that service happens to offer.
So what if it is fake?
What if there is no compromise?
Well, so what?
So you change your password when there was really no need to change your password.
That's benign.
You could change your password all you want without ramification.
Better to change it when you don't need to then not change it when you really do.
So when in doubt, change your password.
It's the first thing you should do.
Whenever you suspect illegal access,
unauthorized access, you get notified of compromise.
You get notified of passwords being exposed in the wild.
Change your password and take that opportunity to make it a good,
strong password and a password that you do not use for any other service at all.
Every password that you have should be unique to the service that you're using.
For updates, for comments, for related links and more,
visit askleo.com/145068. I'm Leo Notenboom, and this is askleo.com.
Thanks for watching.