A few hours ago I got a notification that someone from Moscow was trying to log into my long-defunct Instagram account. I put the associated email into https://haveibeenpwned.com/, and only found one breach with a different password/username pair, which I had rectified back in early 2020. However, in looking for other accounts created long ago, I found that the email/password pair matched Chiff and Fipple, which has never implemented any kind of secure connection. I don’t re-use passwords any more, but long ago when I signed up for C&F, password managers were less widely used and I was unaware of them. While my Instagram account has two-factor authentication since I first registered with my phone number, many other websites do not. Even though the hacker was unsuccessful in accessing my account, it told them that it was a valid email/password pair and could be used to compromise accounts on sites that simply accept username and password. There are automated programs that can run login attempts across popular sites like PayPal, LinkedIn, Facebook etc with incredible speed.
I think there is good reason to double check whether any C&F account information has been compromised, so I highly recommend making sure you have not re-used your C&F password anywhere else. I also highly recommend using a password manager (I like Bitwarden for free use, Lastpass is a little more user-friendly and has a good paid option). Having a password manager made it easy to track down the likely source of the breach, and change the password I used to use on some very old accounts.
I’m guess the mods may be along to tell you but C&F has had an https address for a few years now. If just using http an insecure wifi connection is a common way of people getting your password. I have had scam ‘blackmail’ (“we have ben watching you” etc) emails with a C&F password from a long time ago in the subject line.
Use a different password on every account, none will ever be absolutely secure, as there are several programs available to crack them; but for anything important, use as many safety features as possible.
How exactly were you notified that someone in Moscow accessed your Instagram? Via email? Just asking because receiving an email saying your Instagram was hacked by someone in Moscow is a very common phishing scam right now. I received a similar email last month and I don’t even have Instagram. The scammers create a page that looks very similar to Instagram, you click some link on the email telling you to change your password, it connects you to the fake page and when you enter the info suddenly the scammers have all the info they never had to begin with. Anyway, it works because a lot of people don’t know ……….
The best way to check if you really received an email from Instagram is to go to your IG account’s Settings page > Security > Emails, and see if you’ve actually received one.
It was a legitimate email; I always confirm stuff like that. It’s odd that I never found the HTTPS address of C&F, I have the HTTPS Everywhere extension but have been redirected to the non-HTTPS version of C&F consistently. It’s entirely possible another of my ancient accounts was compromised, but there were only three or four still sharing that email/password pair. If folks are successfully getting an HTTPS connection to C&F then maybe it’s not the source, but the others were “name brand” sites that had not been named in any recent security breaches. Just thought I’d give folks a heads-up in case they hadn’t audited their passwords lately! Home wifi network is locked down with good security.
I just noticed that I’ve been on the insecure version. Whats annoying is that when I type chiff in my browser and it remembers where I want to go, it uses the insecure version. Not sure if this is too difficult for the mods, but I believe you can set it so if someone tries to connect to the insecure version, it forces them to connect to the https one. I have recently converted to a password manager. Makes life much easier.
A link to the secure version of C&F is in the intro to the CCCP, and you can re-establish this as your default go-to. Some of the CCCP’s policy links fall into the nonsecure version for some reason, so if you’re consulting such a page via its link, back out of it when you’re done, or else right-click your links to make them stand apart from the secure version, and you can dispose of them accordingly (my method). Another way to keep the secure version (but old-school and more work) is simply to scroll manually down the secure version of the CCCP. As for other ways to go from secure to nonsecure: I don’t know them. But the good news is that we have the remedy to hand, as described. Works every time.
On the first post of CCCP all the ‘contents’ links start http (in the source as received by the browser). I guess that’s the way it was when the page was written, which may be the same in other old posts. Maybe a mod could edit that page - if it was thought important enough.
At some point my browser started suggesting the secure version when it offered a completion. I guess there is a way of clearing the list a browser builds up.
