What you're saying is more drastic then what they wrote here. If you used the same password somewhere else, then you're going to have change all those passwords.
> Because I'm human and can't maintain 30+ passwords?
The original question was about GoToMyPC providing more details so someone could "estimate the risk".
If you're already reusing passwords, that becomes rather easy: Your risk is dominated by the fact that you reuse passwords across services. No amount of details from GoToMyPC is going to affect that very much--whether you even used their service or not.
Seriously, just start using a password manager. It's not that much effort, even just for the peace of mind that you're finally setting passwords with the desired strength that you already know is necessary, but couldn't afford to maintain / memorize.
The hardest part for me was trying to decide which one to use :) I settled on KeePassX, because it's free and open source, has an Android app, doesn't store your stuff on their servers (just one encrypted database-file you can safely keep synced between devices via whatever method/cloud storage you prefer). I've been keeping an eye on the pro's and cons between various password manager options, and as far as I've seen the biggest downside to KeepassX was that one security researcher didn't like the user interface (it's fine, IMO) whereas the others either keep your stuff on a server somewhere, are not open source, or both.
Yes, someone could compromise your password manager password and then they'd have everything, but at least there's an additional step there. It's not going to protect you against nation-state level meddling with your life, but it will protect you from "random blog got hacked", which is slightly more likely for most of us.
Generally, I remember my login passwords, password manager password, and Google passwords (for email), and then put everything else into the password manager. I have no idea what my HN password is and don't care.
Would be nice if they told us how they hashed it or if they hashed it at all. If the passwords are bcrypt then it wouldn't matter if an attacker got that hash.
For example, if the attacker has hijacked the login form, and I haven't logged in years, then I'm not at risk. Details like this can help us make intelligent decisions. It's one thing if they stored in passwords in clear text, another - if they used MD5, and a third thing - if they used SHA1, bcrypt, etc.
We have to know! Piecemealing this shows they are clueless!
