Received a message from NWFA (I think) instructing me to change my password. Is this legit?

[teflon6string]

Received this message in my inbox:
"Our security check indicates your password is known to be compromised due to data breaches on other websites.
Please change your password now. See this topic in our Help Center for more information."


Is this a real message from NWFA?
Are other members getting it too?
Looks legit, but before I enter my password to change my password...

Read More

 

[ZA_Survivalist]

A mod should see this.. a while back I was messaged by a compromised account. Not sure if that happened on site of off site.. but someone should be able to clear this up.

 

[teflon6string]

It looks to me like NWFA received a list of passwords that are known to be compromised on various other sites, and mine matches one on that list. Easy enough to change, and I should.

I'm just curious if the warning I got was actually from NWFA - or some oxygen bandit.

Is there a particular Mod to whom I should address this directly?

 

[bionic knees]

I got the same thing a while back, changed password and all is good.

 

[Joe Link]

Yep, it's legit, and good on you for checking -- there's a ton of scams out there these days

It looks to me like NWFA received a list of passwords that are known to be compromised on various other sites, and mine matches one on that list. Easy enough to change, and I should.

This is exactly how it works. This service collects passwords found in data breaches. Our software (securely) checks member passwords against this database of known compromised passwords, and you get that notification if your password here matches one in the database. Obviously if you use that password anywhere else, it should be changed there also.

To be clear, your password was not compromised on our website, but through data breaches on other websites. We simply check them against a list of known compromised passwords to increase security for our members

 

[washagonian]

If you change your password, do NOT do it by clicking on a link in the email that "supposedly" takes you to the website to make the change.

Close out the email, open a browser and go to the website directly (NOT by clicking the link in the email).

Then login manually, change your password following the website's protocol.

Using the email link puts you at risk of having your keystrokes logged by a javascript or other spyware.

 

[washagonian]

Yep, it's legit, and good on you for checking -- there's a ton of scams out there these days


This is exactly how it works. This service collects passwords found in data breaches. Our software (securely) checks member passwords against this database of known compromised passwords, and you get that notification if your password here matches one in the database. Obviously if you use that password anywhere else, it should be changed there also.

To be clear, your password was not compromised on our website, but through data breaches on other websites. We simply check them against a list of known compromised passwords to increase security for our members

Thank you Joe, for doing this for the members.

 

[teflon6string]

Thanks fellers. You never know what sophisticated stuff the bad guys might be resorting to these days.

 

[Koda]

If you change your password, do NOT do it by clicking on a link in the email that "supposedly" takes you to the website to make the change.

Close out the email, open a browser and go to the website directly (NOT by clicking the link in the email).

Then login manually, change your password following the website's protocol.

Using the email link puts you at risk of having your keystrokes logged by a javascript or other spyware.

Incredibly important.
So much that NWFA should revise their PM to remove any hotlinks and direct users to change their passwords manually. That assures phishing attacks are thwarted and is a final litmus test for authentic PMs from NWFA.... would never ask for info or send hotlinks asking for info (password changes).


Password changes should always be done manually from a separate browser tab.

 

[matts]

Im not sure if this is the same, but when i have been logged in on a desktop, and then, without logging out, log in on my cellphone, i get that type of message.
Matt

 

[Nosferatu]

And stop using identical passwords across services. Each should be unique and shouldn't even be words, 12+ character combinations of mixed letters, numerals and symbols are best. If you MUST use a rememberable word, a phrase is much better, such as "Stomp3rgothisNutzkickedbyAndy54H@wken!"

Using a password manager is elemental these days. I personally use a combination of Dashlane and Keepass, but there are a half dozen or so reputable ones out there.

Edit: My apologies to @Andy54Hawken for revealing your password, you may want to change it now. May I suggest; "Nosfer@tuis1stepfr0mBeingB@nn3d"?

 

[washagonian]

And stop using identical passwords across services. Each should be unique and shouldn't even be words, 12+ character combinations of mixed letters, numerals and symbols are best. If you MUST use a rememberable word, a phrase is much better, such as "Stomp3rgothisNutzkickedbyAndy54H@wken!"

Using a password manager is elemental these days. I personally use a combination of Dashlane and Keepass, but there are a half dozen or so reputable ones out there.

Edit: My apologies to @Andy54Hawken for revealing your password, you may want to change it now. May I suggest; "Nosfer@tuis1stepfr0mBeingB@nn3d"?

Excellent advice.

Also, if you use Apple products (Mac, iPhone and/or iPad) the built-in Apple password manager is an excellent product. You can easily synchronize your passwords across iCloud (there is no charge for this) so that all of your Apple devices have access to all of your passwords.

If you have a newer MAC with the fingerprint reader, when you go to a site's login page - if the login credentials are already in your Password manager - all you have to do is touch the fingerprint reader and you're automatically logged in.

Maybe too much info - but ..... the fingerprint login is really friggin' kool.

TWYLALTR.

Cheers.