My Accounts being hacked (my fault with old password)

[allfreechips]

So I have a few accounts taken over by someone changing my email to trenkstars@pront........... and of course trying to get payments sent to another BTC addy...

FYI and I am updating all old accounts that I never did

-Chris

PS, also started an account on AGD using my real name to get things changed!

[Former Member 14]

If possible use min 17 characters: upper/lower alpha, numerical and special characters if allowed.

Use a different p/w for every program, email accounts, cPanel login, you name it, everything that requires a password. If you feel uber paranoid, use a different User-login too.

BUT really, programs these days (given hacked accounts, to change payment details are on the rise) aff programs and such, should have security measures in place, so the contact details, or payment details, can't be changed without contacting your AM. Or, even a couple of secret questions (you've answered previously), would stop this crap from happening.

I use this site for that purpose: https://passwordsgenerator.net/

[allfreechips]

Yeah Kyle from Drake was on top of it right away, and yes al new passwords are auto generated long strings, lazy killed me there on a bunch of accounts

[wonderpunter]

Yeah Kyle from Drake was on top of it right away, and yes al new passwords are auto generated long strings, lazy killed me there on a bunch of accounts

password123? or allfreechips2020?

[allfreechips]

How did you get my new one already?

[Malikbhai]

Use Keepass. Been using it for more than 15 years.

[Sherlock]

I am not using superstrong strong passwords for affiliate accounts, that is overkill imo. I use different login names though, bunch of emails and of course proprietary email(s).

I would be much more concerned about the attack vector, you can use as strong passwords as you want but if attackers have access to your device or email, it is pointless. Old password does not mean and should not mean that your acct is hackable.

Are you sure the old password is the reason of the hack? Why?

[allfreechips]

anything touched was with the old password / login name.. Email(s) is mine and its pretty locked down and updated securely

[Sherlock]

Yeah, but how you know that the issue was the reuse of old login/password by some joker. I agree it is the most probable explanation (because the hack occurred only for one combination of login/password and because we know what kind of people work as affiliate managers [not all of them ofc]), but sadly second most probable thing is that your computer or phone was hacked or something.

Imagine that for example your computer is somehow keylogged and they see just partial data. This combination of password/login was the most used so they might try it first and this is why you see hacked just this combination. What I just wrote is not very likely but still possible.

Abusing AGD supports your original hypothesis (the hacker was some affiliate insider, because random virus owner would not know where to go and what to do that quickly). But take care...

[allfreechips]

I agree with the possibilities as I lost my allfreechips.com domain in the past when a hacker got access to my email and transfered the domain... long story but the accounts are consistant, they go in and change the email to another and request payment.

of course I updated the works today already

[Sherlock]

That is very odd. You maybe do some things relatively more unsafely than others or maybe you just do other things and the result is that you are more vulnerable. I am scared of being hacked just by reading what you wrote.

[allfreechips]

Well the domain loss was a pile of bad practices by me and my registrar, where you can get your password via email (not a new one just the password) and then transfer the domain and delete all the emails associated with it.. imagine the confusion making changes via ftp that dont show up...

Lots of layers now between everything I do

[Former Member 14]

I am not using superstrong strong passwords for affiliate accounts, that is overkill imo.

Way back in 2003 or something, not only was a aff site I owned hacked, but also defaced. That was a lesson well learned.

[Sherlock]

Superstrong passwords do not solve much. In fact they create even bigger problem. When I have superstrong passwords everywhere, then I do not remember them. When I do not remember them, I can not work. It is pointless then. I can hold few superstrong passwords in my head but not 100s.

Supersecurity is needed only for really important things like securing crypto. With my PC and phone it is for me on the contrary. I am very lenient and let people hack it, so I can see if the low security is secure enough. Then my high security will be enough for sure.

Also how will superstrong password help you when you put the password somewhere and the password is there for example in plain text when the creators of affiliate system are idiots? Or how can superstrong password help you if you have keylogger in your computer?

I do not get why there is no 2fa on affiliate accounts, especially the ones with cashier. So many problems would be resolved, even the errors with leaked passwords to affiliate managers who are bad actors.

[wonderpunter]

the oother problem is everyone wants a different type password some numerical.. some alfanuemrical some with symbols, some min 8 digits, somne ask me to change every 3 months and im running out of ideas.. i dont want tons of paper to keep remembering

[Sherlock]

Yes this is exactly how overall the system is insecure, because is overloading people with bogus requests. Instead simple 2fa would be much safer.

You can just change last letter(s) of the same Ygwnm&^76 password to something that reminds you the affiliate program. Like here would be Ygwnm&^76gpw, but then obviously, the password is no more strong.

When I read always some nonsense how everything in IT or gambling will be shining soon like Buddha, I always remind myself how even this relatively simple task is so hard to resolve. Now bettingpartners have a new website. They put a lot of work into it. They made separate cashier and stats/marketing, which is great. But why the hell the cashier does not have 2fa?

[Former Member 14]

2fa would make life a lot easier, for sure.

Neteller isn't well liked, for them being pain's in the ass. But the security they've implemented of last, is outstanding, which includes 2fa.

If I can implement on Wordpress (not that I have, but could), then surely aff programs etc., can too.

[Strider1973]

Well, having 2FA everywhere even for the smallest things will just be a lot more work when logging in.

I think the key point is to use different passwords at each website/service. Otherwise it's enough for one single site to get hacked and when a hacker has your email + password he can just try this on 1000s of other websites.

I know it's a pain to have a different password on each website, but that's an absolute MUST.

There are several solutions for this, like using a password manager, or developing an own system (like including parts of the website name into the password, doens't solve the issue when some programs want you to use special characters while at other programs it's not possible to use special characters...!).

[Sherlock]

2fa is not just the google auth or something
2fa is email confirmation for example
2fa is even independent pin/password (Neteller btw had this always or at least from 2005)
2fa can be something device location based or even the thing that has 5dimes, simply digital fingerprint (the problem with 5dimes is that they have it implemented in very bad way)

for cashier (once a month) i could live with google auth anyways

[casinobonusguy]

I use 2fa for everything when it is possible it bite me in the ass though when we went away for 5 weeks and I left my work phone home and didn't get any access codes lol