How Does Google Know my Dark Mod Password????

[NeonsStyle]

Check this out:

1. It says my TDM Password has been leaked, but more importantly,

2. How does it know my Dark Mod password? Are they not encrypted???

3. Noticed it picked up some of the passwords on my phone as well. WTF is going on here? How do they know this?

 

Neon

 

[darksilence]

Chrome knows the passwords that you choose to save. They are stored as plain text.

You should not allow Chrome to save your important passwords, either memorize them or keep them in a piece of paper inside a non-pickable wooden chest.

 

Edited August 10, 2021 by darksilence

[freyk]

And is possible you used the same password at another site,
where it is known that its useraccount storage database is leaked.

Following a review of chrome password manager, the password are stored encrypted in a plain text database-file. 
Chrome "calculate" this password and can compare this with leaked calculated passwords. (that is happened)

So change your passwords frequently.
dont use a online/synced password manager from somebody else,
etc etc,..

Edited August 10, 2021 by freyk

[Zerg Rush]

I use a good system to create strong passwords, which I can remember easily. For example I use 1235 for an account as a password, but I don't use it as is, I use it encrypted. For this I use an app to encrypt text, for example in SHA256 or other systems, with this 1235 becomes

72l6LnLCtvvC5d8Jd2LRaD2CUGhMu9xc6F2Q6+RUues=

which certainly is a strong password which I can repeat whenever I want, only have to remember 1235.

Never trust G☉☉gle

Edited August 10, 2021 by Zerg Rush

[STiFU]

Either the TDM servers got hacked or, much more likely, you used the same login credentials for numerous sites and another site got hacked. You can check your credentials on haveibeenpwned.com. 

With what tool did you get that report you screenshotted?

[Zerg Rush]

For important log in data it is always advisable to use an encrypted mail service, such as those of Proton Mail or Tutanota.
I also use Gmail when I created it out of ignorance many years ago, but I do not use it for anything that is relevant and much less use Google as a credential to register on other sites that offer this possibility.

[NeonsStyle]

@STiFU It was an email I got from Google telling me this. 

@Zerg Rush, whats the name of this app?

[Dragofer]

1 hour ago, NeonsStyle said:

@STiFU It was an email I got from Google telling me this.

Hm, it might be worth looking closely at the URL of the sender - it might not be Google, but a phishing attempt.

[STiFU]

1 hour ago, NeonsStyle said:

@STiFU It was an email I got from Google telling me this. 

In that case, you are likely using chrome or an android phone and stored passwords in some browser. That data gets synchronized with your google account, if you don't deactivate that functionality.

I recommend disabling all password storage in all your browsers and use a proper password manager to generate and store unique passwords for each site. I can recommend Bitwarden for this, as it is very comfortable to use and runs on all the main platforms. With with stuff like this, user-comfort is a very important factor, as I'd find it annoying to always tab between apps to enter my login credentials into a website. I use Chrome with the Bitwarden addon. I enter my master password into the bitwarden addon once when starting Chrome, and the addon will fill out all login credentials automatically.

[Zerg Rush]

Only if you use Chrome itself, Google sync in other Chromium browsers don't exist anymore. I use Vivaldi with its own encrypted sync server, data and passwords without access by Vivaldi itself.

[stgatilov]

You can go to https://haveibeenpwned.com/ and check your email/account.
If credentials leaked from some websites, check if they had the same or very similar password to leaked one.

[Zerg Rush]

I know this site, only one time pwned in the past my Google account password, never others. 

[NeonsStyle]

The only problem with Password generators/managers, is you never know what the passwords are for any of your sites. 
If your drive goes down you lose all that info, and now can't get into any of your sites. This is why I've never used
one. 

[cabalistic]

You should seriously reconsider that stance. Passwords that you can remember are very likely not secure enough, particularly because you probably share them between accounts to some extent.

Good password managers encrypt your passwords securely so that you can easily back them up to cloud storage.

[Zerg Rush]

1 hour ago, cabalistic said:

You should seriously reconsider that stance. Passwords that you can remember are very likely not secure enough, particularly because you probably share them between accounts to some extent.

Good password managers encrypt your passwords securely so that you can easily back them up to cloud storage.

Passwords which I can remember also secure, when I ecrypt them before use. See the Example in what I had converted 1235. What isn't secure is to have your password stored in a server online, using a password manager. If this server fails or is hacked, you can't recover your password created in aleatory manner. But I can recover mine, only remember 1235 and

 

On 8/12/2021 at 3:16 PM, NeonsStyle said:

@STiFU It was an email I got from Google telling me this. 

@Zerg Rush, whats the name of this app?

the text encrypter I use.

There are severals, for Example Encipher.it (AES) is a good choice (you can use it online, but better the app, it's free) https://encipher.it. You can also create your own, not very complicated with the text functions of a spreedsheet (Excel, LibreOffice Calc, or what you use)

Edited August 14, 2021 by Zerg Rush

[cabalistic]

55 minutes ago, Zerg Rush said:

Passwords which I can remember also secure, when I ecrypt them before use. See the Example in what I had converted 1235. What isn't secure is to have your password stored in a server online, using a password manager. If this server fails or is hacked, you can't recover your password created in aleatory manner. But I can recover mine, only remember 1235 and

I said backed up, not stored, didn't I? My Keepass file is automatically synced with cloud storage, and as a consequence I have multiple fairly recent copies on my laptop, PC and my server.

You do still have the problem that you need different passwords for different accounts. If you use the same encrypted passwords for all your accounts, that is most certainly not secure. I guess you could just use the domain name in your scheme, if your encryption is strong enough. You'll just have to hope that the websites didn't put some braindead rules for passwords into place that your encrypted output doesn't conform to

[Zerg Rush]

No, I have diferent passwords for each site, stored locally and in my head.

[AluminumHaste]

I like to subscribe to the 4 random word passwords. Like Horse Cloud French Toast or something like that. Easy to remember, not guess.

 

[cabalistic]

 

5 minutes ago, AluminumHaste said:

I like to subscribe to the 4 random word passwords. Like Horse Cloud French Toast or something like that. Easy to remember, not guess.

You can go that route, but two things that are important to point out:

1. 4 words may be cutting it close, probably better to choose 5 to 6, at least for important accounts.
2. you must not pick the words, they must be chosen randomly! If you pick the words, there will be patterns in the sequence which significantly weaken the strength of the password. I know it's in the name of the method and you're probably aware, but many people still have a tendency to try to pick or "massage" the generated words, so I wanted to emphasize it

Still, remembering too many of those phrases simultaneously is not an easy feat, so I'd still recommend a password manager, even if it's just a backup for your memory...

[AluminumHaste]

I have them written down on a page in my house.......I know I know

[datiswous]

On 8/10/2021 at 3:57 AM, NeonsStyle said:

Check this out:

1. It says my TDM Password has been leaked, but more importantly,

The info in that screenshot doesn't say that your TDM account is leaked. It says:

1. One password for an account is compromised

2. You have some weak passwords for 3 sites (one is TDM)