On: Got an account on a site like Github? Hackers may know your e-mail address

the gravatar email recovery hack has been known for years, they are recycling an old topic.

luckily my email isn't a secret as I publish it everywhere willingly.

The problem is that since they know your email address, they can find your email from leaked databases... Then try that password to own your repo...

what password?

Assuming:

* A hacker has a leaked database

* Your email and password are in this database

* Your public email is the same one used in the database

* Plain-text passwords are easy to extract from this leaked databases

* You use the same password and email combination other places

* Other places with that email/password don't use two-step authentication

Then if they have your email they can get your password and try it other places

> You use the same password and email combination other places

This is the problem. Every password for every account you create should be unique. Bonus points if you use a unique email alias for every account you create too.

That one single password you use on all webpages, clearly.