Would it even matter if we all just changed our passwords?
Hide in plain sight. We all change to the same password and next time they get a big list of 1.2 billion passwords it will look like the password harvesting robot is broken.
Whist I usually decry the whiners saying BB is being clickbaity, I cannot think of any reason for adding â: are you affected?â to the post title other than being clickbaity, since the damn post doesnât actually tell anyone anything about whether they are affected.
heh, response to this sort of breach is part of my day job.
change your email password, that is usually âcenter of the snowflakeâ. and even if it is one char different given that they may need to test so many unless you are already on someones poop-list that will keep your crown jewel safe. then go and do what i know all of us do (in addition to brushing our teeth and adhering to the 30 second principle): keep changing your passwords on a regular basis.
pastebin should be full of trolls for the next few weeks (and yes, i said that firmly tongue in cheek :D).
Letâs go with correcthorsebatterystaple just to make it simple.
Also, I love that I can use bugmenot@bugmenot.com/bugmenot as ID/password on dozens of sites. Thank you, bugmenot, for existing.
did you know correcthorsebatterystaple, as a literal password, achieved a more than 1% share not too long ago? so yes, randallâs methodology is perfect, just donât use the sample code 
(also windows 8/8/1 machines that are hooked to a microsoft account limit you to 16 characters, which almost made me accidentally spill my coffee on my laptop on purpose).
So they ⌠have all of the usernames and passwords?
Heh, I just checked my keepass database. I am up to 160 usernames and passwords.
Username/ pass is fundamentally broken. I can kinda deal with it, with 20+ years of 50-60 hours a week dealing with security problems. The rest if the population is screeewed.
In the meantime set up recovery phones for email and banks. If you must a master list of passwords in a small safe isnât a terrible idea. And anything truly importantâbaby pictures, mementos of loved ones, trip videos should be backed up in several locations.
We can all make more money, but damnit I need my old old-cat photos 
Dear Xeni,
.LOL, youâll find out soon enough.
Happy Birthday, asshole.
âŚand just donât use the same password from one site anywhere else.
A crappy system to differentiate your passwords is better than one impossible-to-remember password that you use in multiple places.
Yeah, even though adding a 1,2,3 isnât a good practice, the fact is any average person can scrape 100k usernames and passwords off of paste bin a month. So trivial changes arenât ideal, they stop the mass account take over for at least a few days.
âHold Security would not name the victims, citing nondisclosure agreements and a reluctance to name companies whose sites remained vulnerable.â
So itâs important, but not really that important?
Wait a minute. Some internet security company announces that half a trillion passwords are compromised, and the solution is to buy their services - and we just take them at their word and commence to panic?
I wonder if they found out my password is âgullibleâ?
People keep saying this, and I guess Iâm not sure what it is that you do with the internet. My LastPass account currently has passwords for 240 different sites in it. A lot of them are probably forums and shit that I used once for some very specific thing and then forgot about, but I could easily scrape together 20 or 30 just from email, social, banking, utilities, shopping, and forums/comment sections that I use regularly. âChange them all on a regular basisâ is not really practical.
For now, Iâm gonna stick with my current strategy, which is to use LastPass to generate 20 characters of unique line noise for every site I use. If somebody jacks my password for, I dunno, the Steven Brust Fan Forum or something, then have fun trying to sell Viagra to a dozen jaded fantasy readers, 'cause thatâs all youâll be able to do.
No no no, you donât understand. BoingBoing writers are bloggers, not journalists. That means anything they write is absolutely beyond reproach for any reason and you should feel bad for suggesting otherwise.
The ad copy there is relentlessly sketchy, but if you follow it through they seem to be just asking for your name and email address so they can check it against the big list. I think, anyway. I havenât gotten the response email that they promisedâIâm guessing theyâre pretty snowed right now. In any case, theyâre not asking you to set up an account or hand over your credit card right off the bat.
Somebody jacked my account for a forum once. I let them keep it. They made more sense than I did.
Was it BoingBoing? ::mind blown::
