Account got hacked yesterday

[Keres]

unless SE got internally attacked it's impossible for someone to figure out your SE Account ID

It's not really that hard:

- If you have a keylogger
- If you use the same user ID you use in other online services

But even in that case, as the OP said, setting up OTP protection on your account will go a long way to preventing unauthorized access.

[Jennestia]

It's not really that hard:

- If you have a keylogger
- If you use the same user ID you use in other online services

But even in that case, as the OP said, setting up OTP protection on your account will go a long way to preventing unauthorized access.

Actually, if he got keylogged he'd be just as easily session hijacked to get a OTP since they don't immediately decay to allow users time to input them.

[Keres]

Actually, if he got keylogged he'd be just as easily session hijacked to get a OTP since they don't immediately decay to allow users time to input them.

Yeah, it's possible, but I wasn't under the impression that most keylogging was done in real-time. Like, the keylogger phones home every so often and the script kiddie can parse through the logs at their leisure. Someone'd probably have to have it out for you personally to be giving you that sort of individualized attention.