Nest Alert: Protection From Pwned* Passwords
A colleague just received an “Urgent Security Alert – Action Requested” email from Nest. At first glance it looked like either a phishing attempt or one of the way-too-often breach notifications we all receive these days. Instead, it was a real alert notifying him that the password he uses for his Nest account had been compromised in a data breach – not at Nest but somewhere else. Nest encouraged him to update to a unique password and enable two-step verification (additional authentication beyond a password, usually referred to as multi-factor authentication).
While it’s not clear exactly how Nest determined that the password was compromised, it could have come from security researcher Troy Hunt’s recently updated Pwned Passwords service (part of his “have i been pwned?” site). Via this service, you can enter a password to see if it matches more than half a billion passwords that have been compromised in data breaches. A hashed version of the full list of passwords can also be downloaded to do local or batch processing. (“Pwned” is video gamer talk for “utterly defeated,” as in “Last time we played, I pwned him.”)
Hunt created this service in response to the National Continue reading
