Checking if your password is already in a breach
In the previous session we established why a password you can memorize is, by definition, already too weak. Kelly still hasn't forgiven me for that one. The logical next step is to determine whether a password you currently use has already been exposed in a known breach.
Consider what a breach actually is. Companies get compromised — not hypothetically, but routinely, large firms and small ones alike. When it happens, the affected list of usernames and passwords is sometimes published online, where anyone can retrieve it. If your password appears on such a list and you still use it anywhere, that constitutes a real exposure, because attackers run those lists against banks, email providers, and everything else, on the assumption that you reused it.
You almost certainly did reuse it. Most people do; I did too, before I knew better.
The site I actually use
The relevant tool is a well-established site called Have I Been Pwned. The name is unfortunate; the tool is useful. It is free, and it is operated by a security researcher rather than a company trying to sell you something. You enter your email address, and it reports which known breaches that address appeared in.
It does not display your actual password on screen, which is by design. What it returns is the set of breaches your email was part of, so you know precisely where to go and make changes.
The same site includes a second function that checks a specific password, rather than an email, against known breaches. That function is more sensitive, so let me explain why it remains safe to use. The site does not transmit your full password anywhere. It uses a partial-matching technique so that your actual password never leaves your device in complete form. I won't pretend to walk you through the underlying mathematics. I've read about it, I trust the people who built it, and I'll be direct: that is roughly the limit of my technical knowledge on the subject.
Steps to do this at home
- Go to the site. Enter your primary email address.
- Read the result. It will either report that you're clear, or list the breaches by name and date.
- Don't be alarmed by a list. Some of these breaches are years old and the associated account is long dead. That's acceptable.
- For any account that remains active — particularly email, banking, or anything tied to your real name — change that password. Not a minor edit. A full replacement, generated by your password manager.
- To check a specific password you still use somewhere, use the password-check function on the same site and see whether it comes back flagged.
- If it is flagged, change it today. Not this weekend.
That is the entire exercise. Roughly ten minutes if your email appears in one breach, longer if you've been online since the dial-up era and it appears in nine.
Kelly, again
I raised this with my brother Kelly some time ago. He reuses a single password for essentially everything — checking account, email, all of it — and won't stop regardless of what I say. I pulled up the breach checker and showed him his password sitting in a leaked list from some site he probably registered with in 2011 and forgot about.
He looked at it, nodded, and changed his password on one account. One, out of roughly thirty. That troubled me more than it should have. But I'll take one; it is better than zero, and it is his information and his decision, exactly as it is yours.
Why this matters more than it feels like it does
A password you can memorize is already too weak — we covered the principle. This is the demonstration of it, not merely the theory. If your password is on a breach list, it is no longer a hypothetical. Someone already holds it, stored in a file, ready to try it against your bank login.
This may be the single most useful five minutes in the entire course. It requires no purchase and no installation — only typing your email into a field and reading the response.
One firm caution: do not type your actual bank-login password into some arbitrary site that claims to check breaches. Restrict yourself to the one I named, Have I Been Pwned, or to your password manager's built-in breach check if you have one configured, since most now perform this automatically and simply flag the result for you.
Before next time
Check your primary email address on the breach site before the next class, and if anything active comes back flagged, change it. Bring your questions if the results were unclear; that happens more often than you'd expect.
~kenneth