Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

773M Password ‘Megabreach’ Is Years Old

krebsonsecurity.com

Post reply on HN
Print view View original

31–40 of 177 posts

Re: 773M Password ‘Megabreach’ Is Years Old

#31

Post by atnurbel »

Jordrok wrote: post #19

I can't remember if it was haveibeenpwned.com or some other site, but I seem to recall once a few years ago checking my email on a site which also showed you the first two characters of the password which had been compromised. Maybe it has since been discontinued because of security concerns, but I found it really useful at the time because it let me know that the leaked password was an old one that I hadn't used in…

haveibeenpwned has an api to check your password against their known list that only requires to send the first 5 characters of the sha-1 hash: https://api.pwnedpasswords.com/range/5407a.

You get a list of corresponding hash suffixes and check if yours is there. https://haveibeenpwned.com/api/v2/#SearchingPwnedPasswordsBy...

Re: 773M Password ‘Megabreach’ Is Years Old

#32

Post by ViViDboarder »

sbarre wrote: post #21
dhruvrrp wrote: post #15

In the first image with the telegram id the other id is for discord. I don't recall discord being e2e encrypted so that is an interesting choice to offer. Especially since discord is known to have access to all data since they regularly remove chats/servers that don't follow their tos.

The seller may be using a VPN to mitigate this.

Discord would still have the contents of the messages.

Re: 773M Password ‘Megabreach’ Is Years Old

#34

Post by buro9 »

petercooper wrote: post #30
ascar wrote: post #18

Since a few weeks ago I receive spam emails threatening me with an old password I no longer use. I wonder if it's related to this collection. It starts with: > I am well aware [old password I think I swapped out everywhere, but definitely in all important places, when I started to use random keepass pws two years ago] is your pass words. Lets get straight to the point. None has compensated me to check about you. You…

I received the same email to "myspace@" my domain. I wouldn't have used that email anywhere else..

Now we know where to try the associated password.

Makes me think I need a better strategy on the username side to not leak that info.

Re: 773M Password ‘Megabreach’ Is Years Old

#35

Post by orangeshark »

ascar wrote: post #28
easytiger wrote: post #22

Earlier quoted context omitted.

> Bitcoin blockchain explorers show that the addresses are recently created, and that people have sent them money. I find it difficult to reconcile someone tech savey enough to use bitcoin falling for a scam of this nature. On the otherhand, it might explain a lot about the crypto space!

The email contains: > You will make the payment by Bi‌tco‌in (if you do not know this, search 'how to buy b‌itcoi‌n' in Google). The top result is from coinbase [1]. I would say everyone capable of online banking is capable of following these steps. [1] https://www.coinbase.com/buy-bitcoin

Wonder if it would be a good idea for coinbase to mention the possibility of you being scammed...

Re: 773M Password ‘Megabreach’ Is Years Old

#36

Post by yingw787 »

I was terrified of my old email being compromised because somebody tried logging into it from Windows (I don't use Windows) and because I had an identity theft scare a month back. What I'm doing going forward is having a personal email acct I don't give out (with 2FA thru U2F), and creating burner GMail accounts that forward emails to that email using POP3. I'm already pwned because I use my personal email for a lot of things, but I like to think it keeps my attack surface minimal.

Re: 773M Password ‘Megabreach’ Is Years Old

#37

Post by thisisweirdok »

Yeah I knew this when I got the haveibeenpwned email about it. Just brushed it off with a "oh, that password is making the rounds again." The password in question was compromised something like 5+ years ago.

Having a 20 character password in a vault and 2FA is a great piece of mind now. I don't even have to bother looking into it.

Re: 773M Password ‘Megabreach’ Is Years Old

#38

Post by ascar »

yingw787 wrote: post #36

I was terrified of my old email being compromised because somebody tried logging into it from Windows (I don't use Windows) and because I had an identity theft scare a month back. What I'm doing going forward is having a personal email acct I don't give out (with 2FA thru U2F), and creating burner GMail accounts that forward emails to that email using POP3. I'm already pwned because I use my personal email for a lot…

Adding a bit of security on the identification side (usernames/emails) isn't completely useless, but the focus should be on securing authentication. I.e. never use a password twice and add 2FA to everything even vaguely important to you.

With password managers that's also way easier than managing a lot of email accounts.

Re: 773M Password ‘Megabreach’ Is Years Old

#39

Post by hag »

Jordrok wrote: post #19

I can't remember if it was haveibeenpwned.com or some other site, but I seem to recall once a few years ago checking my email on a site which also showed you the first two characters of the password which had been compromised. Maybe it has since been discontinued because of security concerns, but I found it really useful at the time because it let me know that the leaked password was an old one that I hadn't used in…

You CAN check breached passwords here: https://haveibeenpwned.com/Passwords, if it's a common password it doesn't mean that it's necessarily your account that's been compromised.

Re: 773M Password ‘Megabreach’ Is Years Old

#40

Post by brazzy »

MarsAscendant wrote: post #27
ascar wrote: post #18

Since a few weeks ago I receive spam emails threatening me with an old password I no longer use. I wonder if it's related to this collection. It starts with: > I am well aware [old password I think I swapped out everywhere, but definitely in all important places, when I started to use random keepass pws two years ago] is your pass words. Lets get straight to the point. None has compensated me to check about you. You…

> recorded watching porn What a damning position to be in, in 2019.

Well... https://www.smbc-comics.com/comic/we-know
Post reply on HN