Comment by shostack | Hacker News Reader

Comment by shostack | Hacker News Reader

Parent Full thread

Two questions as a non-security guy...

1. My two main email addresses were both flagged across the Bitcoin Security Gmail dump, the Gawker Gnosis hit, and then two game DB breaches (D&D Online, Heroes of Newerth). If I've changed my gmail passwords since then with a very strong 1Password PW, is that pretty much all I should be doing at this point?

2. I was never notified by any of these places that my email and password had been compromised. I'm particularly concerned by the two games. Do these companies have any legal obligation to disclose what happened? In the case of D&D Online they have "Dates of birth, Email addresses, IP addresses, Passwords, Usernames, Website activity." So I'm curious what recourse I have.

I have to say that the irony in all of this is that my two personal email accounts were both caught up in multiple lists, but none of my family members (who are all considerably less tech-savvy than I am) show up at all.

> is that pretty much all I should be doing at this point?

Google also offers two-factor authentication; if you're willing to bear the extra inconvenience, it's one of the biggest possible security wins.

https://www.google.com/landing/2step/

To add to this, it isn't too bad of an inconvenience. You can remember a device for 30 days, so you take an extra 20 seconds 12 times per year.

I complete a Google 2FA much less than once a month. I think the 2FA cookie must live for a month, but my login cookie lasts for much more than that.

On a new device, I do of course need the 2FA token.

Changing your Gmail password is not necessarily what you need to worry about because that wasn't compromised. HIBP told you your account at other places e.g. Heroes of Newerth was compromised. So if you used a password for that account that you also used in other places, then you're vulnerable. This is why password re-use is a really bad idea.

I'm curious about the answer to your second question. I was under the impression that they were under obligation to do so, albeit not immediately.

Reply on news.ycombinator.com