HoldSecurity

[foxy]

Read all the stories about the Russian Hackers this month. Supposedly HoldSecurity will check out your email addresses free-of-chargee for 60 days.

http://www.pcworld.com/article/24625...ml#tk.nl_today

I'm registered at 175 sites. I sent them my 5 email addresses, but received an all-clear for only one.

I just checked out HoldSecurity and found this:
http://cqcounter.com/whois/?query=holdsecurity.com
Do we have any indication that HoldSecurity is a fake? Or that the breach was a fake to bring in business for their company?

[fink]

I see no indication that Holdsecurity is questionable. The fact that PCWorld.com is using them as a reliable source for security information shows they are trusted within the industry.

[foxy]

OK. But I am concerned that they checked out only my most unimportant address. And why would they run the site on GoDaddy?

Has anyone received a notice from any of those 420,00 websites about changing your passwords?

[HAN]

Brian Krebs vouches for Hold so I am satisfied that they (he) are legit. (I trust that Krebs is an honest man.)

That said, I am not convinced that I should run out and change all my passwords (over 200!) I do NOT like the way Hold is telling users whether their passwords have stolen or not.

As for advice, if a user feels vulnerable from this breach, you should consider (at least) changing your most valuable passwords (personal or financial sites.) Maybe all of them.

FWIW... At this point, I haven't changed any. (I don't always follow my advice!)

[foxy]

I have only one sensitive PW, so I will change that. But now my bank has also sent me an electronic gizmo for creating PINs.

Those companies should be notifying us if they were hit.