“If you do make the mistake of reusing passwords, you are running the risk of having your password compromised in one place (perhaps via a phishing attack or key logger or data breach) and then hackers using it to unlock your other online accounts.

“You should never use the same password on multiple websites. “I think it would be best for people to change their passwords – and, if they were re-using them, to learn the lesson never to re-use passwords again. Ultimately, the leak is just the latest reminder of the risks of re-using passwords. But if that same password is being used elsewhere on the net (and sadly, we know that many people use the same password for multiple websites) then the consequences could be significant.” “If your Adobe password is compromised, that possibly won't have a huge impact on your online life. It's quite possible that they also stole the keys that Adobe was using on its database – and so could have already unlocked the information.” “ let's not forget that the hackers gained access to Adobe's systems and stole product source code as well as the database. “Clearly those users who chose longer, more complex passwords will be less at risk than those who chose common dictionary words or the most commonly chosen passwords,” says Graham Cluley, a security consultant.

So even if a user’s password is unique, and the hint means something only to them, they should still consider their data at risk. That would mean that attackers would have a colossal store of emails and passwords which they could test on other sites around the web. There is no simple way to reverse the encryption, but 'brute force' attacks can sometimes figure out what the key used to encrypt them is. That last one is most likely the password itself and so the 1.9m who used 123456 as their password have had it compromised. From there, they can look at the password hints, which Adobe didn’t encrypt at all, to try and guess what the password might be. So if the database shows 1.9 million people whose password, when encrypted, reads “EQ7fIpT7i/Q”, then researchers know that they all have the same password.

The method, called ECB mode, means that every identical password also looks identical when encrypted. Firstly, it encrypted all the passwords with the same key secondly, the encryption used a method which renders the encrypted data insecure. Encryption errorĪs well as allowing the data to be stolen in the first place, Adobe made two other serious errors when storing the data. If it isn’t, then they are safe, but if it is, then they need to seriously check whether they reused the password anywhere else – because it is as good as revealed. Using , a tool created by programmer users can check if their email address was included in the 10GB database leaked last week.

Adobe Password Leak