Here's something that you may have seen in the last couple of years and it's going to
keep going on.
You get an Alert that you need to change your password.
But then you read further into the alert the notice that it's coming out from whatever
website has sent it and you find out that they claim that they haven't been hacked.
Nobody's broken into their site.
So if that's true then why do you need to change your password.
If nobody has broken into their site, nobody's hacked into them or your account there.
How is it that you need to change your password?
Well, it turns out it's relatively easy for people to get hold of your password without
ever breaking into the site itself.
Let me show you how it works and how you can protect yourself against it.
Here's a typical setup.
Say you've got all these different websites that you belong to.
Maybe there's Yahoo, there's Goggle, there's iCloud of course.
There's shopping sites like Amazon.
All of these have an ID and a password.
Now chances are your ID is the same for every single one.
It's your email address.
Your password though should be completely different for each one.
It should be not only different but randomly generated.
So it should look something like this.
So each one is randomly generated say from a password management program like OnePassword
or LastPass.
Or maybe from just using Safari's ability to create random passwords.
Everyone is completely random.
In that case, that's great.
However a lot of people don't do this.
Even people who know a lot about security and feel like they know what they're doing
will do something more like this.
You can see that a whole bunch of passwords are the same.
Now they still might be randomly generated but they figure well I've memorized this randomly
generated strong password let me stick with it and use it for all these different sites.
It may seem like a good idea but in fact it's not.
You should definitely have randomly generated ones for each site.
So here's what happens.
Say Site B is broken into.
Maybe it's a site you don't even care about.
Maybe it's just some game that you played a long time ago or a shopping site and you
didn't even give them you credit card or anything.
It's nothing that important.
Somebody breaks into it who cares if they got to your account.
But they broke into that site and they got your password.
If they got your password there that means that they actually have your password for
all the different sites where you're using that same password.
What do they do with it?
Well what they do with it is they will go and test that against other sites.
So, for instance, let's say Site D there, Whocares.com.
You don't care about it.
Not only do you not care about it but most people don't.
It's not that important of a site and maybe because of that they didn't have that great
security.
Somebody broke in a stole all the passwords.
Now they take your ID and password and all the ones they've stolen and they try it at
the other sites.
Like Site J which I put here as ICloud.com.
They try all those IDs and passwords at ICloud.com and when they work they don't even do anything.
They just log right back out.
They compile all the ones that work into a big list and they can sell them for lots of
money or use them for something.
So your iCloud password was just stolen because you used the same password somewhere else
and that site was broken into.
It could be that maybe this Whocares.com site is some site that doesn't even care themselves
if they get broken into so it's not even in the news.
They don't even publicize it.
For all you know your iCloud.com password is compromised and you may not even realize
it.
This is why it is important not only to use random passwords but to use a different one
for every site.
Cause imagine if you had indeed set a different password for every single site and this one
was compromised, that only that one would be compromised.
If it's a site you don't care about you may never even know.
It doesn't matter.
If it is a site you care about you only need to change that one password.
You never have to worry about any of the other sites being compromised because it's a totally
different password there.
That's why it's important.
Of course, you should go and take a further step of using two-factor or two-step authentication
if it's available at any site but for general protection for almost all sites that don't
have that, and even sites that do, use a different password for every site to be safe.