But email services appear to have a harder problem due to the catch 22 where you can't log in to reach the password reset email if they were to reset your password.
What do they do?
You could also do things like having the reset require the user to have a token that was issued before the compromise to prove you were able to authenticate before the leak happened.
Primary article instead of shitty forbes blog spam.
It is 183 million email (not gmail) addresses in the collection of which 14M haven't been seen before on have i been pwned.
This hackernews title should be changed. (Currently: 183M Gmail Passwords Leaked)
The argument is no longer valid, time to move off Gmail.
There might be a lot less gmail adresses showing up as pwned now.
Those are mine
I hope you're using a site that requires at least 6 (but no more than 10) uppercase, lowercase, numeric, and special characters.
larholm•3mo ago
"Gmail Passwords Confirmed As Part Of 183 Million Account Data Leak"
EForEndeavour•3mo ago