Password question

waterman10

When I go into my Google account > manage your Google account > security and sign in - it says my live.com (Hotmail) password is weak and has been compromised.

I changed my Hotmail password and made it very strong but still on my Google account it says it's compromised and weak. Anyone know why that is and what I can do? Any help would be appreciated.

TimeLord1

It is completely normal to see this error pop up. When you change your password directly on Microsoft/Hotmail, Google Password Manager doesn't automatically know you changed it.

You could enter it into Google password directly edit and save or clear cache in both apps. Turn device off and on.

Exodi

Have you updated the password in Google Password Manager?

Swipe

I had this problem, google still showing it as compromised on the front page even though the old account had been deleted from google passwords and all passwords were now showing as not compromised by the security check. I can't remember exactly how I fixed this, but I think I went into 'Security and Sign-in' and acknowledged the old warning entry in there. Then the warning on the front page went away.

waterman10

I've never heard of Google Password Manager before to be honest. I've just looked up what it is!

I'll go into it and see if I can figure it out. Thank you

PRAISETHESUN

If you're using a password manager (unsure if you are?) there's basically no reason why you shouldn't be using the longest most random password you can (eg. 99 character random alpha-numeric + symbols). Generate multiple passwords and make them unique for every website you login in to. Just make sure you can memorise your master password (the one you use to lock your manager) and make it secure.

You also don't mention it, but I'd also make sure you are using 2FA for every site that supports it, including your email and PWM.

mta999

What is the difference in real life between a 99 character random alphanumeric plus symbols password and a password such as MyShed123#£ given that Hotmail and Google lock you out after a certain number of attempts?

Neil_Jones

https://forums.moneysavingexpert.com/discussion/comment/82086198#Comment_82086198

Its nothing to do with "a certain number of attempts", because if the password has been taken in a data breach, then they'll be in first time. This is why you should use 2FA where available and a long password, and a password manager can help with this because nobody can remember anything more complicated than "MyLeftFoot81!" much less reel it off every time required.

Outlook and Google offer passwordless sign-in, which contrary to how it sounds, is actually more secure because there's nothing to compromise. You sign in on a website and have a request sent to your phone to approve the log-in through an authenticator app (which doesn't always have to be the one they offer you, you can use Google Authenticator for a Hotmail/Outlook account for example)

The overarching point is that 99% of people will, when left to their own devices, use the same password or a slight variation on that password for every web service going. Password managers solve this to an extent.

mta999

thanks for the interesting summary and yes I agree if there is a (plain text) data breach then it doesn't matter how long or complex the password is because they can see it.

this does not alter the fact that you do not need an overly complex or long password for a system that enforces a maximum number of sign in attempts before locking you out

PHK

It's worthwhile to point out that there's often more to a password than just logging in.

For some organisations the password is part of the encryption key for the data saved in whatever account that you log into. This means that the organisation can't see your data only your pattern of activity. It also means that both parts of the encryption key are not stored by the organisation in an unencrypted form.

So if the organisation that hosts the data is infiltrated and the data taken, then the hackers will have as many attempts as they like to decrypt the data. The longer the password the longer it will take on average to crack and decrypt the data.

You can get an idea as to how long a password will take to crack using the tool at https://bitwarden.com/en-gb/password-strength/