mistakes ยท post 03 of 7 in this channel
Reusing a password you already use somewhere else
Everybody knows not to. Most people do it anyway, and here the price is different from everywhere else.
the three wethenorth market addresses
hn2paw7zfvndw3dovycegeqmvvnf4pl67b3g2p7pohjlzavloosh73id.onionhn2paw7zrgujyhnt6mgxlt2q6uhgbke4itpqitxhyfbumq3wtnckbuyd.onionhn2paw7zadwkcra3qzv5e4q547i7e5lvxm62cfxqftuqdu7moiu2ceyd.onionprinted the way they were handed over. no labels, no numbering, nothing here says which one to try first. this feed never opens them, so it has no status light, no percentage and no date of checking to give you.
how reuse actually gets exploited
Some unrelated site gets breached and its credentials end up in a list. Nobody targeted you. You were in a database.
Those lists get tried automatically against other services, at enormous scale, because it costs almost nothing to try. That is the whole attack and it has no craft in it.
So the question is not whether anyone is interested in you. It is whether a password of yours is in a list somewhere, and you have no way of knowing.
why it costs more here
On an ordinary site, a compromised account is recovered through email and the damage is bounded. Here there is no email and no reset, as covered in the password.
The account also holds messages, order history, delivery details and possibly a balance. It is a richer thing to lose than a shopping login.
a variation is not a different password
Adding a number, a symbol or the site name to a password you already use does not create a new one. It creates a predictable transformation of an old one.
People generating these lists know about that pattern and try the variations automatically. It has been standard for a long time.
If the base is compromised, the variations are compromised. The only thing that helps is a password with no relationship to the others.
the username makes it worse
Reused password plus reused handle is the complete package. It gives somebody both halves of the credential and tells them where else to try it.
The post on the username covers that side. The two mistakes are usually made by the same person in the same ninety seconds.
what to do instead
One password, used here and nowhere else, long enough to be resistant and stored somewhere you will actually find it. That is the whole prescription.
A manager handles this well. Paper handles it well. Memory handles it badly, and memory plus confidence handles it worst of all.
if you already did it
Change it now, while you still have access, which is the only window in which changing it is easy.
Then check the recovery phrase situation, because if the password was reused there is a decent chance the phrase was never stored properly either.
Those two omissions travel together, because both come from the same ninety seconds of moving quickly through a form. Fixing one is a good moment to check the other.
And do it now rather than adding it to a list. This is a category of task that never gets done later, as signing up points out about the whole registration process.
replies
a reader askedNobody is targeting me. Does this really apply?
the answerThe attack does not involve anyone choosing you. It is a list being tried against services in bulk, which is why ordinary people with nothing interesting about them get caught constantly.
a reader askedIs a password manager not a single point of failure?
the answerIt is, and it is a single point of failure you can lock properly, rather than dozens of accounts sharing one string. The trade is clearly favourable and it is still a trade.
a reader askedI changed the password. Am I fine now?
the answerFor this account, largely. If the same password is on other services, those are still exposed, and that is a bigger job than one change.
what this post is not Not a claim that any particular service has been breached. It is about a mechanism that works regardless of which specific breach supplied the list.