Credential Stuffing Attack

[BoomerDutch]

4 hours ago, brukar said:

I'd rather suggest KeePass. It's free, free, open source, has multitudes of clients for every platform I've ever heard of, supports 2FA, you have full control over the location of your password file, and can run entirely local or in a cloud of your choosing. The only cost is a little bit of learning, but even I could get my head around it. Didn't take long either.

Also a fine choice, my point is simply having a password manager would help for most people.

[HanZie82]

On 2/13/2026 at 12:08 AM, Mark Kaine said:

Yeah, I thought that's the answer, sure... but also not a "perfect" solution or anything.

 

Exactly. But I don't, ever!

 

Then you also wont ever forget to back up and the login credentials of your pasword manager.

Also self hosting is the way to go! That IS the perfect solution.

 

 

On 2/11/2026 at 4:16 PM, BiotechBen said:

I raise you Organic chemistry compounds.

 

2,4-dimethyl-3-cyclohexene-1-carboxaldehyde. 

 

One of the compounds that makes soap and perfume smell "fresh and crisp" 43 characters including special characters, and if it requires a capital letter: you can Capitalize the D in dimethyl

I'm sorry to burst your bubble but these are in pasword lists too.
Any word that exists, can get combined with other words with numbers and spaces inbetween and all.
Also now with ai in the mix, every word used in here are in such lists. So yeah, goodluck without MFA...
The best is random characters + MFA.

[Spotty]

If you have been impacted and still require assistance recovering your account please contact Forum Support. In order to recover your account you will need access to the email address associated with your account and as part of recovery you will be required to set a new password for your account. If you would prefer your account be deleted forum support can also assist in deleting your account (if you have access to your account you can delete your account yourself via Account Settings). 

 

A number of people whose accounts were accessed have provided additional information to assist with our investigation. Almost everyone that I have spoken to were already aware that their login credentials had been exposed in previous data breaches from other websites or malware infections. No specific source (ie. which website data breach) for the credentials used has been identified. Thanks everyone who helped provide more information.

 

Based on our own review and the additional information provided by members I am confident that the credentials used did not come from the Linus Tech Tips forum. We have found no indication that any other systems or user personal information were accessed.

With this information in mind our advice remains the same:

1. Perform a malware scan to detect and remove any possible malware on your device(s)
   • There is no point resetting your passwords if there is malware present on your system that will capture the new passwords
2. Reset passwords on all websites you use, using strong & unique passwords for each website
   • A trusted password manager can help manage having unique passwords for each website and most can also generate strong random passwords.
3. Wherever possible use Multi-Factor Authentication (also known as 2FA)
   • Multi-Factor Authentication will help prevent access to your account even if your password is exposed
   • Physical device or App based MFA options are recommended, but email or SMS based MFA options are better than none
   • Multi-Factor Authentication can be enabled for the LTT forum in the Security & Privacy menu in Account Settings.

 

We will continue to strive to identify and mitigate these attacks, however, the best way to ensure your account security is to secure your account using strong & unique passwords and preferably 2FA. 

 

I do not anticipate I will have any further updates to provide and will archive this post in Bugs & Issues in the coming days.

[BiotechBen]

8 hours ago, HanZie82 said:

Then you also wont ever forget to back up and the login credentials of your pasword manager.

Also self hosting is the way to go! That IS the perfect solution.

 

 

I'm sorry to burst your bubble but these are in pasword lists too.
Any word that exists, can get combined with other words with numbers and spaces inbetween and all.
Also now with ai in the mix, every word used in here are in such lists. So yeah, goodluck without MFA...
The best is random characters + MFA.

I mean, I don't claim that ANY password is unbreakable, but having something that is not easily social engineering vulnerable is about the best base for most people. MFA is ALWAYS going to be preferred, and there are a few that I do One-time-use codes only (partially for forgetting the completely unique password, partly for the fact that they don't actually have 2FA as a standard, but DO have one-time-codes as an option)

[SimplyGone]

I use a password system.  don't like the idea of any software having all my passwords.  I have a little book in a drawer next to my computer.  It doesn't contain a single full password though.  the way I set up a new password is I'll use one of 6 'common' parts that I keep in rotation and then 'append' that with a string of random characters.  It's only these characters that get written in the book with a 'memory aid' pointing to which 'common' part was used.  These common parts have never been written down and they never will.  I also use 2FA.  

 

Side question:

Can I use Google Authenticator for 2FA here?

[Skiiwee29]

29 minutes ago, SquirrelChunk said:

Side question:

Can I use Google Authenticator for 2FA here?

Yes. 

 

https://linustechtips.com/settings/account-security/

[benny001]

@BiotechBen is such a nerd with his organic compounds and I absolutely love it. 

Spoiler

no offense  please don't guess my non-organic compound password to hack my account and remove this comment.

 

[BiotechBen]

13 minutes ago, benny001 said:

@BiotechBen is such a nerd with his organic compounds and I absolutely love it. 

  Hide contents

no offense  please don't guess my non-organic compound password to hack my account and remove this comment.

 

It took me 5 tries to pass, you bet your ass I'm gonna use it. LMAO 

If for nothing else than to spite the universe.