I Got Hit

DVDR_Dog · 2026-07-15T11:49:04+0100

Somebody somehow compromised my Paypal account.
They sent 2-$100 gift cards to [email protected] from someplace in California.
Paypal is being a huge pain in my ass, luckily my credit card co has a heck of a fraud detection division and they are on it.
They have already credited my account. I have concluded Paypal has turned into absolute bullshit. It's very possible they had a huge data breach at the end of April, wondering if that's what happened. Closing all ties with them as soon as this is done. Suggest you don't use Paypal any more. They are no longer what they insisted they were. Some capital investment co must have bought controlling interest in them. When that happens, down the toilet they go.

AFFASocial · 2026-07-15T17:01:46+0100

I am guessing you use a short password?

For better protection: use 50-character passwords; you can create them here: https://www.avast.com/random-password-generator#pc

A 50-character password is effectively uncrackable by brute force—we're talking numbers so large they're almost meaningless in practical terms. Here's the actual math so you can see why.

The core formula

Time to crack ≈ (possible combinations) ÷ (guesses per second)

The number of possible combinations depends on your character set size raised to the power of length:

Lowercase only (26 chars): 26^50
Mixed case + numbers (62 chars): 62^50
Mixed case + numbers + symbols (~95 chars): 95^50

Rough numbers

Even in the weakest realistic case—lowercase letters only—26^50 is about 10^71 possible combinations.

A very fast modern cracking rig (think a cluster of GPUs) might manage somewhere around 10^12 to 10^13 guesses per second against a stolen, weakly-hashed password file. Against a well-protected system (proper hashing like bcrypt/argon2, rate limiting, etc.), it's more like a few guesses per second at most.

At 10^13 guesses/second: 10^71 ÷ 10^13 ≈ 10^58 seconds. For context, the universe is about 4×10^17 seconds old. So even the worst case here (all lowercase, unrealistically fast attacker) would take longer than the age of the universe by a mind-boggling margin.

If you use upper/lowercase, numbers, and symbols across 50 characters, the number is so astronomically larger it's not worth writing out—brute force simply isn't a realistic threat at that length.

Where the real risk actually lives

For a password that long, brute-forcing isn't the thing to worry about. The realistic risks are:

Reuse—if that password leaks from one breached site (even hashed) and you used it elsewhere, that's the actual attack vector, not guessing.
Phishing/keyloggers — length doesn't help if someone tricks you into typing it into a fake site or captures your keystrokes.
Weak hashing on the service's end — if a site stores passwords poorly, length helps less than you'd think.
Memorability — 50 random characters is hard to type/remember reliably, which sometimes pushes people toward patterns (repeating a phrase, keyboard walks) that are more guessable than true randomness, even at that length.

I would also check your browser extensions for known keyloggers. Do a web search and say I am using the following browser extensions. Do these have any known keylogger-hacked issues?
Enabling Two-Factor Authentication: This adds an extra layer of security to your account.

Welcome to TheWindowsForum

I Got Hit

DVDR_Dog

AFFASocial

Similar threads

Support TheWindowsForum

Trending content

Welcome to TheWindowsForum

I Got Hit

DVDR_Dog

AFFASocial

Similar threads

Support TheWindowsForum

Log in

Trending content