Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Third option: there is no "fix," on either end, so telling people to change all their passwords is pointless.


I fixed it for myself by using a password manager. I only have to worry about securing the (encrypted) database, which is comparatively trivial.

I'm still vulnerable to the "supercomputer cracks your encryption" attack but that's orders of magnitude better than having my bank account compromised because some blog leaked my universal password.

Edit: If there were no fix, changing all of your passwords would be the only option besides letting the Internet at large have your accounts. Unless I'm misreading you.


The example was 10,000 sites, so changing all of your passwords being the only option is no option at all.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: