AI and Leaked Credentials Monitoring: Knowing You're In a Breach

End-of-lesson check

15 questions · take it digitally for instant feedback at tendril.neural-forge.io/learn/quiz/end-creators-ethics-safety-AI-and-leaked-credentials-monitoring-r13a7-adults

1. What makes creators specifically high-value targets for credential stuffing attacks compared to typical users?

   1. Creators use more complex passwords that take longer to crack
   2. Compromised creator accounts provide immediate monetization opportunities: fraudulent sponsorship solicitation, crypto scam broadcasts to large audiences, and ransomware leverage
   3. Creators are more likely to reuse passwords across platforms than average users
   4. Platform APIs give creator accounts administrative access to follower data

2. What is credential stuffing, and why do leaked credentials enable it?

   1. A hacking technique that uses personal information to guess security questions
   2. Automated testing of leaked username/password combinations against multiple platforms, exploiting password reuse
   3. Phishing attacks that direct creators to fake login pages
   4. Social engineering attacks targeting creator team members

3. Which MFA method provides the strongest protection against SIM-swapping attacks for creator monetization platforms?

   1. SMS-based 2FA linked to a mobile phone number
   2. FIDO2 hardware keys or passkeys, which are tied to the physical device and cannot be redirected via carrier manipulation
   3. Email-based 2FA codes sent to a dedicated creator email
   4. Time-based authenticator apps with 6-digit rotating codes

4. Why should a creator's public business contact email and their platform account recovery email be different addresses?

   1. Platform TOS prohibits using the same email for both purposes
   2. The public contact email is constantly exposed to phishing and data collection; if compromised, it should not cascade to account recovery access
   3. Different email addresses improve email deliverability for business communications
   4. FTC guidelines require separate email addresses for business and personal use

5. What is a 'credential dependency map' and why should creators maintain one?

   1. A record of all sponsorship contract values indexed by platform
   2. A document mapping which email recovers which accounts, which platforms use SSO, and which accounts have financial access — enabling prioritized response to a breach
   3. A spreadsheet tracking all creator account usernames for brand partnership verification
   4. A legal document listing all platforms where a creator has signed terms of service

6. A creator's email appears in a breach dump. AI suggests a rotation plan ordered by account criticality. Which account type should be rotated first?

   1. Lowest-traffic social media platforms first, working up to highest-traffic
   2. Email accounts used for account recovery, because email compromise cascades to every platform that uses that email for recovery
   3. Oldest accounts first, because they are most likely to have weak original passwords
   4. Free tier accounts first, because paid accounts have stronger built-in security

7. How do breach monitoring services like Have I Been Pwned function, and what is the practical value of their alerts to creators?

   1. They scan active login attempts in real time and block suspicious access
   2. They index publicly disclosed breach data and notify registered emails when those addresses appear in newly indexed datasets — providing weeks-to-months of lead time before attackers act on the data
   3. They directly contact platforms to initiate password resets when a breach is detected
   4. They provide legal protection if an account is taken over after a monitored breach

8. What is the relationship between password managers and breach monitoring in creator credential security?

   1. Password managers make breach monitoring unnecessary
   2. They serve different functions: a password manager prevents credential reuse (proactive defense); breach monitoring detects when credentials are exposed (reactive early warning). Both are needed.
   3. Breach monitoring services automatically sync with password managers to update exposed passwords
   4. Password managers are the primary breach monitoring tool through their dark web scanning features

9. What is a quarterly credential audit, and what should it verify?

   1. A quarterly review of platform analytics to ensure account performance is meeting targets
   2. A periodic review verifying that all active platform accounts have unique passwords, current MFA configurations, and up-to-date recovery information
   3. A review of all sponsorship agreements for credential-sharing clauses
   4. A legal compliance review of platform terms of service changes

10. A creator has their YouTube account taken over. Which action is most time-sensitive in the immediate response?

    1. Post a public announcement on Twitter explaining the situation
    2. Contact YouTube's account recovery team and change the recovery email and phone number on all linked Google accounts before the attacker does the same
    3. Document the incident for law enforcement before taking any platform action
    4. Contact sponsors to pause any active campaigns until the account is recovered

11. Why does AI lack the capability to 'recover an account already taken over'?

    1. Platform APIs don't allow AI tools to interact with account security features
    2. Account recovery requires platform-authenticated identity verification and human-to-platform interaction that AI cannot execute on the creator's behalf
    3. AI credential security tools operate only preventively and have no incident response functions
    4. Account recovery is blocked for 72 hours after takeover to prevent automated access

12. A creator shares platform login credentials with a remote team member to manage their account. Which security risk does this directly create?

    1. Platform terms of service violations only — no actual security risk
    2. The credential is now exposed to the security posture of another person's devices and accounts, significantly expanding the breach surface
    3. The team member's actions will be attributed to the creator's account but not logged
    4. Platform analytics become inaccurate when multiple users share credentials

13. Breach monitoring provides early warning that a creator's email appeared in a breach dump. The creator's password manager shows a unique password was used on that service. What should the creator do?

    1. Take no action since the unique password means no other accounts are at risk
    2. Rotate the exposed password on that service and monitor for any sign the email address is being tested against other platforms, but note that unique passwords prevent cascade exploitation
    3. Delete the email address and create a new one immediately
    4. Contact the breached service's lawyers to join the class action lawsuit

14. What is the optimal breach monitoring alert frequency for a creator's primary monetization email addresses?

    1. Monthly digest is sufficient for most creators
    2. Instant alerts for primary monetization and recovery emails; weekly digest for secondary accounts
    3. Quarterly, aligned with the credential audit schedule
    4. Only when a major breach is publicly announced in the news

15. Which analogy from the lesson most accurately describes the relationship between breach monitoring and a password manager?

    1. Breach monitoring is the lock; the password manager is the alarm
    2. Breach monitoring is the fire alarm; the password manager is the fire-resistant building — monitoring provides warning, but structural defense prevents the catastrophic outcome
    3. Breach monitoring is the insurance policy; the password manager is the backup copy
    4. Both tools serve the same function and using one makes the other redundant