Infosec pro Troy Hunt HasBeenPwned in Mailchimp phish

Privacy News
1

Ironic that the guy that supposedly notify others about them being pwned are now among source of pwn too. This is why you use email alias service, people. Simplelogin, addy, duck, own custom domain etc theres plenty of options out there. Its not safe anywhere. Nowadays just using 1 email address everywhere might be as bad as using 1 password everywhere. Stay safe out there.

2 Likes
2

I feel like I am having a stroke reading this headline :face_with_spiral_eyes:

edit: Maybe I really was since I kept mis-reading “HasBeenPwned” as “HaveIBeenPwned” and that’s why it didn’t make sense to me lol

1 Like
3

I think they were trying to make a pun?

These headlines are getting out of control…it doesn’t really seem professional on their end haha.

4

Honestly his own write-up is a lot more informative than this article.

Unfortunately, Mailchimp doesn’t offer phishing-resistant 2FA:

600Ă—410 48.6 KB

By no means would I encourage people not to enable 2FA via OTP, but let this be a lesson as to how completely useless it is against an automated phishing attack that can simply relay the OTP as soon as it’s entered.

:clap:

1 Like
5

This was actually on the list of things i want to add to Privacy Guides but I always recommend people who start their privacy journey some indexing solutions of where your data is.

One of them is actually the global access and erasure requests on Mailchimp:

If you didn’t use aliases always this is a very good starting point to see what companies still hold on to your data.

6

This only shows how an individual - even a pro - cannot really stand against a targeted attack.

QubesOS intensifies

What hope can we actually have? :thinking:

Its messed up…

7

Can you please explain the point of aliases, does your original data still be available to companies?

8

Not sure i understand your question correctly. Are you asking if it is beneficial to change existing emails at companies into alieas?

9

Where’s my passkey support :face_with_steam_from_nose:

10

It’s a solvable problem we just need to switch away from passwords and TOTP to passkeys/hardware keys.

2 Likes
11

I’m still not 100% sold on passkeys due to their (non)portability issues.

12

Yes!