Hackers may well try your username and old passwords elsewhere. (In fact I once got a blackmail email that pretended to have hacked my computer - and the “evidence” was that they knew an old password that had been replaced years before.)
They absolutely do this, and that's why it's so important for services and sites that store credentials to use strong hash algorithms and salt. Never ever ever store passwords, even in encrypted form. Encryption can be reversed into plaintext; hashing is explicitly designed to be one-way. A given string of characters will always generate the same hash value when the same hash algorithm is used, but it's not possible to reverse the process and use the hash to reveal the original string - you have to brute force every possible string, which is computationally unfeasible for sufficiently strong algorithms.
The "salt" part is used so that neither the client (your browser) nor the server (whatever you're logging onto) has the complete picture. You have the password, but don't know the right salt. The server knows the salt and the salted hash of your password, but never stores the actual password. A malicious attacker cannot take information from any single entity and get a complete logon credential.
There is still risk at the moment of authentication where a man in the middle could capture your password, but this is where HTTPS/TLS come in, and that's why you should never log on to or trust services that don't use secure connections. These protocols encrypt web traffic and use a hierarchy of trusted "certificates" to ensure that you're communicating with the authentic service. Without that, an attacker could intercept your logon attempt.
And this is why government policies that seek to add a "law enforcement back door" to web encryption is a terrible awful stupid very bad idea - attackers would only have to crack the backdoor key to gain access to
all web communication, instead of needing to individually get the keys for every site/service you connect to.
I remember T-Mobile had a major breach
after being warned about their plaintext password storage. Every customer's username and password and email address and phone number was stolen in plaintext - no encryption, no hashing, just toally open and available. And hackers absolutely started automating attempts to log on to every bank, Facebook, every email service,
everything with that information. Using the same password across services means that some people were easily the subject of identity theft...all because T-Mobile couldn't be bothered to implement a very simple and standard practice for storing password information.
-->“The human understanding when it has once adopted an opinion (either as being the received opinion or as being agreeable to itself) draws all things else to support and agree with it.” - Francis Bacon"There are two novels that can change a bookish fourteen-year old's life: The Lord of the Rings and Atlas Shrugged. One is a childish fantasy that often engenders a lifelong obsession with its unbelievable heroes, leading to an emotionally stunted, socially crippled adulthood, unable to deal with the real world. The other, of course, involves orcs." - John Rogers
“A world that can be explained even with bad reasons is a familiar world. But, on the other hand, in a universe suddenly divested of illusions and lights, man feels an alien, a stranger. His exile is without remedy since he is deprived of the memory of a lost home or the hope of a promised land. This divorce between man and his life, the actor and his setting, is properly the feeling of absurdity.” – Albert Camus
"...the pious hope that by combining numerous little turds of variously tainted data, one can obtain a valuable result; but in fact, the outcome is merely a larger than average pile of shit." - Barash, David 1995...
"Many that live deserve death. And some die that deserve life. Can you give it to them? Then be not too eager to deal out death in the name of justice, fearing for your own safety. Even the wise cannot see all ends." - Gandalf, J. R. R. Tolkien: The Lord Of the Rings
"The last enemy that shall be destroyed is death."
1 Corinthians 15:26King James Version (KJV)
-->Nihil supernum -->
-->
™ Version 4.2
(1)
