How secure is your password?

[Ole Anderson]

I still don't see what they gain. If that know my password to a forum, are they going to log in as me and post stupid things? Sorry, got that covered already.

If they get into my bank, I'll know about it after the first transaction or two, and the account will be locked and I'll get my money back from the bank.

If they get into my email, they'll see how boring my email life is. I'm not emailing the President. They might find out that a friend's kid hit a home run in a baseball. What will they do, email people with my account? Like I care?

I've not yet seen the reasoning in my life of how devastating it would be.

I think passwords have become the boogy man for the media. Now, if you're hacking into a business that has intellectual property, then I get it, but I don't see the value in the end, home user.

So you know have access to my netflix account? Good, could you send me the login, because I can't remember it.

This is some funny stuff, man! I tend to agree with you. I had a credit card hacked last spring, 36 transactions in 2 hours for $5600 at bricks and mortar stores before the bank caught on. They never explained why it took so long. Didn't cost me a penny. Doubt it came from hacking my password though, probably someone swiping my card and selling the info online.

[Jason Kowell]

Meh, not really. While it may come from his account, the login IPs would quickly resolve any doubt as to where it originated from. During investigations of such matters, email accounts are only useful in narrowing the parameters ("could person 'X' be sending this")... but the real evidence is the IP address for the connection. This would be resolved long before he was ever approached about such issues.

Not necessarily. Legal proceedings/criminal investigations are notoriously slow, and if the police/feds think you're involved in kiddy porn they're probably going to grab you immediately on probable cause. Sure, it'll get cleared up, but you're still going to have a very unpleasant experience. Granted, the chances of this actually happening if some random person got a hold of your account is probably less than the chances of you getting hit by lightning, but it isn't an impossibility.

[Dan Hintz]

Not necessarily. Legal proceedings/criminal investigations are notoriously slow, and if the police/feds think you're involved in kiddy porn they're probably going to grab you immediately on probable cause. Sure, it'll get cleared up, but you're still going to have a very unpleasant experience. Granted, the chances of this actually happening if some random person got a hold of your account is probably less than the chances of you getting hit by lightning, but it isn't an impossibility.

Sorry, but no. I have intimate knowledge of how FBI investigations into CP transpire. There must be multiple, actionable loggings of activity, and those activities must be verified to avoid exactly what you describe. If the wrong person is pulled in, a case against the agency is wide open, so they are required to do their due diligence. Mistakes happen, but it's difficult to make them given the process in place.

BTW, stolen accounts (or "specifically created for that purpose" accounts) are often used for such activities, but eventually mistakes are made and the guilty parties are found out.

[Curt Harms]

Meh, not really. While it may come from his account, the login IPs would quickly resolve any doubt as to where it originated from. During investigations of such matters, email accounts are only useful in narrowing the parameters ("could person 'X' be sending this")... but the real evidence is the IP address for the connection. This would be resolved long before he was ever approached about such issues.

It seems pretty easy to spoof MAC addresses. Is it as easy to spoof I.P. addresses? I have no clue.

[Dan Hintz]

Is it as easy to spoof I.P. addresses? I have no clue.

Extremely (but only up to a specific point). Which is why so much more investigation goes into things. The ISPs are always involved to one degree or another to avoid IP spoofing from causing a case loss.