Ah, fair enough.

I think the biggest risk there isn't a poker site data breach, but the breach of another site where you use the same password (which of course you shouldn't be doing, and probably aren't - but others do).

As an example, I started getting some emails a while ago that were concerning when I got the first one, until I read more about it. Here's the main part of the email:

The password? It's one I use on dozens of sites. I use it on most sites that require me to sign up. I recognized it immediately. Scary, right?

Well, I looked into it more. I went to the very site Josem linked, and found that my email address had been involved in one data breach, at Ticketfly. This confirmed for me what I suspected was true - that the email was all bullshit. Dude hasn't been spying on me, has no access to my computer. He's just bought the breached database, emails the same thing to everyone in it, and if 10 or 20 or 100 people bite, he's made a tidy profit.

But that still leaves my Ticketfly info out there. This guy won't be the only one to have bought the database. So, if I had used that same email/password combination at a poker site, I'd be quite vulnerable. But, of course I hadn't. I only use that password on sites I don't care about - the "throwaway" signups that are part of daily Internet life. Any poker site, financial institution, social media site, this forum - anywhere that someone else getting my credentials would really matter - gets a unique 20+ character password. So, I guess someone could screw with my New York Times subscription or my IMDb account if I ever created one, but that's about it.

I'm not going to say a poker site data breach is impossible, but most people have their accounts compromised through far more pedestrian means than having to hack a presumably secure database. Social engineering, trojans/keyloggers, or obtaining your data elsewhere.

Oh, I should add - that not using the same email/password combo practice I'm so proud of? Yeah, I wasn't that savvy about 12 years ago, when I did use the same password a lot of places. Lost over $1,000 on an ewallet, and I never did figure out how it happened, but I'm pretty sure it was from a data breach on a less secure site. I was extremely lucky to get the money back, and that's when I got Keepass and beefed up my password security.

imagine not having a 2FA/PIN in 2020 for EVERYTHING monetary.

how do these people even turn their PC on

Different passwords for all sites: banking, email, social media, admin password, separate AV and firewall, router, Need I go on?

Yes, 2FA is correct, but a secure method of storing multiple different passwords (which itself is password protected) is the way to go (especially if 2FA is not available). My btc sites use 2Fa, though not always sms (sometimes).

I can keep checking my poker site(s), and my balance is still there - even when someone panic posts their's is gone. This is the hacker time, politics, someone just team hacked (teenager leader) the twitter accounts of Joe Biden, Barrack Obama, some large corporations, and then sent bogus tweets out collecting tons of BTC. They did use sophisticated methods, which I can probably float under the radar.

Awhile after the US election, this propensity should die down, and when these kids go back to school (obviously a few geniuses, misguided, bored).

Rough ranking of security options:

1) Just password
2) SMS
3) RSA Security Token or equivalent


For most people, #2 is likely to be enough, because the idea of a specific hacker obtaining your password, and then going to your phone company and getting a SIM for your number is, to put it literally, a "fantastic" risk for most people.