Hacker News Reader

Comment by michaelt | Hacker News Reader

It's surprising to me that 60% of people don't appear to have changed their compromised passwords.

Is there something wrong with how we tell people their passwords have been compromised - do you think we aren't making it clear enough what they need to do, or how important it is that they do it?

View on HN

I think his pie chart drives us to an incorrect conclusion here. It's not that people haven't changed their compromised passwords. The problem is actually that people choose inane passwords, like "password" and "123456". When people are doing that, you're bound to see significant overlap between the two sets.

When the Last.FM leak surfaced, I e-mailed all my non-technical friends who used it, warning them and explaining why and how they should change their passwords. Sadly, my message was received with a general tone of "you computer nerds, always complaining", and promptly ignored.

People just don't care.

I suppose it's possible that many of these accounts were inactive, or people may have forgotten even signing up for the service.

Or perhaps, despite all the reports in both tech and normal media, they just chose not to bother.

What if there was a database of compromised email accounts and their passwords. Responsible websites could poll this database on a daily bases and reset the passwords of members who's accounts have been compromised on other websites. This way, if people use the same password on all websites, the responsible websites operators will protect their members accounts from being compromised.

I know there are a ton of holes with this but maybe this initial idea could lead somewhere.

Yeah, it's the importance.

And if 50,000 passwords are cracked, what are the odds that someone is going to use the cracked password to enter your account and do nefarious things, instead of the other 49,999 accounts? Pretty low. And with Yahoo Voice, what's the worst that's going to happen, really?

If it's not the password to your bank account or Facebook, most people are going to figure, it's probably not going to affect me.

Reply on news.ycombinator.com