Russia hack is not that scary

The New York Times published an article this week that has shocked the public. The article says that a Russian cybercrime group by the name of CyberVor has amassed this astoundingly large number of credentials from upwards of 420,000 distinct web sites.My immediate response was: Yeah, so?In the context of the story it would seem that countless passwords are now known to this criminal group, and we should be panicking and changing all of our passwords.But wait a minute. Hold Security, the company that found this hack, may have a commercial interest in this reaction. Hold Security offers to tell companies if their usernames and passwords were compromised for the princely sum of $120. Arguably, Hold Security stood to make more money out of this story than the Russian hackers themselves.Rather than go down the rabbit hole, let's focus on what this really means and how we should react.While 1.2 billion is a big number, it appears that many of these credentials could have been obtained from previous large-scale breaches such as Adobe, Sony, LinkedIn, RockYou.com and eBay. The totals from these sites alone adds up to close to half a billion.We can also assume that many of the 420,000 hacked websites were Mom and Pop blogs, forums and other places where people often consider using a "throwaway" password. The concept is that things like your email, social media and bank require secure, unique passwords. But all the other junk in our lives can just use a simple, less secure password.The criminals don't have the passwords in most cases. They have cryptographic representations of the passwords known as hashes. These hashes come in a lot of varieties with varying degrees of security associated with them. The purpose of a hash is to slow down an attacker from being able to acquire your password if a password database is stolen.This hashing is most effective if you follow good security practices, like not using dictionary words, and making sure to include numbers and symbols in your password. People in general are bad at choosing passwords. That means hashing is often only a speedbump for a determined attacker.But the hashes bring out the truth of the matter. The criminals don't necessarily even have your password. They have a hash that could result in them discovering your password, especially if it is poorly chosen like password123 or qwrtyasdfg.Many of these stolen hashes may have been obtained some time ago, which means they are less useful to the crooks now. Of course, we don't know the truth and can't analyze what is known because Hold Security is trying to figure out how to monetize the knowledge, leaving even the experts a bit in the dark about how serious a discovery this truly is.My advice? Keep calm and carry on. It is always a good practice to use strong passwords and different passwords on the different sites we use and change them if we have reason to believe they might be compromised.There are many tools available to assist with automating this task, making it only a minor inconvenience to keep track of your new stronger passwords. Many are available at no cost. And if we have learned anything during our first 20 years of web surfing, it's that we need a helping hand with our passwords.Hold Security's findings are interesting. If the research community gains access to the information we will all jump in with both feet to determine how it happened, what it means for Internet security going forward and possibly even who is behind the attacks.But for the rest of the world? It's business as usual. Think before you click, do your best to follow best practices with regard to your privacy and safety and enjoy your online experience. It's not as scary as it looks.(CNN)Bakudaily.Az