Security Breech from Bill Goodwin- UPDATE IN POST #77

[t206fanatic]

I received the same email. Very troubling.

[ValKehl]

Originally Posted by t206fanatic

I received the same email. Very troubling.

+1. Jim, thanks for quickly taking the actions you did.

[pawpawdiv9]

I just looked at the same email too!
I actually just looked at his auction listings.
I am in the same boat as to why the 'private password/username' was there.

[buymycards]

I also received this email. My username and password was unprotected in the body of the email. When I used this info to log into Heartland, Google told me that there was a data breech and that I should change my password immediately, which I did. I wanted to log into my account to see if my credit card info was listed. Thank heaven it was not transferred to Heartland Auctions from the old site.

Rick

[pawpawdiv9]

^^^interesting???
I am gonna try and log-in and see if this happens, and if so change mine.
BTW- i also sent a message thru the site's contact page about this matter.

[Bugsy]

They shouldn't even have access to my password in the first place, let alone sending that in an email. Very concerning.

[brass_rat]

I would imagine that a lot of users reuse passwords across sites. This is a good reason not to do that.

Password managers are a good thing... KeePass, 1Password, etc.

[x2drich2000]

Originally Posted by brass_rat

I would imagine that a lot of users reuse passwords across sites. This is a good reason not to do that.

Password managers are a good thing... KeePass, 1Password, etc.

You mean my password shouldn't be Password123 on every site?

[glynparson]

Originally Posted by x2drich2000

You mean my password shouldn't be Password123 on every site?

Wow I never thought of adding the 123. I just went with password. Lol :-)

[ullmandds]

he must be upset that disney is closed?

[T206.org]

Originally Posted by brass_rat

I would imagine that a lot of users reuse passwords across sites. This is a good reason not to do that.

Password managers are a good thing... KeePass, 1Password, etc.

Spot on advice.

When I received the email from Bill I was alarmed but not overly worried, because I use 1Password and have a different password for every website.

[buymycards]

I was thinking about using a password manager, so I looked through the notebook that I use to keep track of websites, usernames, and passwords, and I found that I have nearly 140 usernames and over 100 different passwords for 226 different websites.

I'm not sure what that says about me and the amount of time that I spend online. Nerd? Yes. Nothing better to do? Most of the time. Obsessed with baseball cards? Certainly. Spending too much money? Yup. Having fun? Oh yeah! Going to try to cut back on the amount of time that I am online? Hell no!

[bobfreedman]

Guys, I apologize for the confusion and the mistakes we made in sending out the User Names and Passwords. We have reset everyone's passwords to a randomly generated value. When you log in for the first time, you will be forced to change your password or you can go to Forgot Password and change it immediately.

As for other auction companies being able to see PW's, the vast majority cannot see your passwords nor your Max bids. We do have some older smaller legacy companies that can and we are working with them to turn them off. I will not name them so do not ask but it is a very small amount and they are very small companies. Please accept my apologies once again.

I will not be responding to this thread further.

Bob Freedman

[Jim VB]

Changing your password is a futile exercise if the software company makes it available to the auction house.

At that point, it’s no longer “secure.”