"A data breach on a site or app exposed your password" message

[D Oliveira]

With the new chrome update whenever i log in my appgini applications this message pops up:



Anyone experiencing that? Is there a possible fix?

[pbottcher]

Hi,

change your password. There is not much else you can do.

[D Oliveira]

Hi,

change your password. There is not much else you can do.

Every user that logs in my website gets that message, not just me

[onoehring]

Hi D Oliveira,

let's stay with you (not your customers for a moment): Think about this: Are using a different password for your different logins? If you answer this with YES, I would find it very strange to get such a warning.
There are password breaches every day, so maybe see this as a "general" warning to actually use strong and different passwords.
You can also check for breached passwords on sites like https://haveibeenpwned.com (similar: Identity breach: https://sec.hpi.de/ilc/search?lang=en )

Can you use a different browser without that warning? Is there a chance to investigate how google checks for breaches?

Olaf

[a.gneady]

Hi D Oliveira,

let's stay with you (not your customers for a moment): Think about this: Are using a different password for your different logins? If you answer this with YES, I would find it very strange to get such a warning.
There are password breaches every day, so maybe see this as a "general" warning to actually use strong and different passwords.
You can also check for breached passwords on sites like https://haveibeenpwned.com (similar: Identity breach: https://sec.hpi.de/ilc/search?lang=en )

Can you use a different browser without that warning? Is there a chance to investigate how google checks for breaches?

Olaf

Thanks Olaf. I'd like to add a link that explains how Chrome checks for login breaches: https://www.wired.com/story/chrome-79-password-check/
From the above link:

All of these Password Checkup features work for people who have their username and password combos saved in Chrome and have them synced to Google's servers. Google figures that since it has a big (encrypted) database of all your passwords, it might as well compare them against a 4-billion-strong public list of compromised usernames and passwords that have been exposed in innumerable security breaches over the years. Any time Google hits a match, it notifies you that a specific set of credentials is public and unsafe and that you should probably change the password.

So, maybe you're using this same username/password in a site that have been breached before. It's not recommended to use the same password in multiple websites -- even if it's a strong password.

[D Oliveira]

Hi D Oliveira,

let's stay with you (not your customers for a moment): Think about this: Are using a different password for your different logins? If you answer this with YES, I would find it very strange to get such a warning.
There are password breaches every day, so maybe see this as a "general" warning to actually use strong and different passwords.
You can also check for breached passwords on sites like https://haveibeenpwned.com (similar: Identity breach: https://sec.hpi.de/ilc/search?lang=en )

Can you use a different browser without that warning? Is there a chance to investigate how google checks for breaches?

Olaf

Thanks Olaf. I'd like to add a link that explains how Chrome checks for login breaches: https://www.wired.com/story/chrome-79-password-check/
From the above link:

All of these Password Checkup features work for people who have their username and password combos saved in Chrome and have them synced to Google's servers. Google figures that since it has a big (encrypted) database of all your passwords, it might as well compare them against a 4-billion-strong public list of compromised usernames and passwords that have been exposed in innumerable security breaches over the years. Any time Google hits a match, it notifies you that a specific set of credentials is public and unsafe and that you should probably change the password.

So, maybe you're using this same username/password in a site that have been breached before. It's not recommended to use the same password in multiple websites -- even if it's a strong password.

thank you for the clarifications ahmed and olaf