Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A decade of Have I Been Pwned

troyhunt.com

Post reply on HN
Print view View original

101–110 of 181 posts

Re: A decade of Have I Been Pwned

#101

Post by ziddoap »

mike_d wrote: post #20
ziddoap wrote: post #13

Earlier quoted context omitted.

> On the other hand, I feel like SpyCloud does not get enough credit for having a dataset 30x bigger and working directly with companies to actually mitigate credential reuse Not sure if it is your intent, but this implies that HIBP does not work directly with companies to mitigate credential re-use. It does. Some examples would be their partnership with 1Password and other password managers, Firefox, their partnersh…

It would be like comparing HN to Facebook, they are both technically operating social media sites but I don't think anyone would argue they are doing so at the same scale. HIBP ultimately is a hobby project that was really good at bringing the publics attention to the problem and booting Troy's social profile.

How many governments, password managers, web browsers, and law enforcement agencies does one need to be partnered with to transcend "hobby project" territory?

Re: A decade of Have I Been Pwned

#102

Post by dylan604 »

unaindz wrote: post #85
dylan604 wrote: post #50

Earlier quoted context omitted.

what's the learning curve of a GenZer? When boomer says don't look this up on the internet, it's not because they want the information for themselves. It's because they already have something burned into the memories, and are hoping to save you from the same.

It's human nature to be curious and nothing to be ashamed of. And if someone really doesn't want you looking into something, they won't even mention it.

Which is why the story of the Apple is so bizarre.

Re: A decade of Have I Been Pwned

#103

Post by stuckkeys »

Sephr wrote: post #76

I have memories of this site providing me with an excellent experience. Now it's just a cash-grab, asking for $169.50/year just to see 100 breached accounts! I use unique email addresses (breach canaries) on every website to detect when sites leak my data. When I tried to search for my domain results with a previous domain ownership verification, I got hit with this error: "In order to search a domain with any more t…

You can download the DB from the DarkNet and run it locally so you don’t have to pay. The only downside is, you have to manage this db yourself and frequently update it. But it is similar. I have seen lot of these (cash-grab) services pop up offering API DB access for a cost.

Re: A decade of Have I Been Pwned

#104

Post by eganist »

Sephr wrote: post #76

I have memories of this site providing me with an excellent experience. Now it's just a cash-grab, asking for $169.50/year just to see 100 breached accounts! I use unique email addresses (breach canaries) on every website to detect when sites leak my data. When I tried to search for my domain results with a previous domain ownership verification, I got hit with this error: "In order to search a domain with any more t…

Encountered the same. My hope is that there's a pricing scheme for people like us; may be worth reaching out.

Re: A decade of Have I Been Pwned

#105

Post by [deleted] »

koolba wrote: post #31
gumby wrote: post #8

Earlier quoted context omitted.

> haveibeenfucked.com Years ago we had friends, a couple in which the wife was pregnant. They were actually a bit embarrassed that “everyone will know that we ‘did it’”. A level of squeamishishness I could not have imagined!

> They were actually a bit embarrassed that “everyone will know that we ‘did it’”. Most people would be more embarrassed if the wife is clearly pregnant and nobody thinks they “did it”.

[deleted]

Re: A decade of Have I Been Pwned

#106

Post by gumby »

onionisafruit wrote: post #26
gumby wrote: post #8

Earlier quoted context omitted.

> haveibeenfucked.com Years ago we had friends, a couple in which the wife was pregnant. They were actually a bit embarrassed that “everyone will know that we ‘did it’”. A level of squeamishishness I could not have imagined!

That reminds me of my early twenties being embarrassed when my wife told her parents we are trying to get pregnant.

When people would ask us, “when will you have a second baby?” we started to answer, “oh, we figured out what causes it!” which usually shut down that line of questioning.

Re: A decade of Have I Been Pwned

#107

Post by CoffeeOnWrite »

uxp8u61q wrote: post #73
CoffeeOnWrite wrote: post #68

Earlier quoted context omitted.

Be satisfied with fixing the new passwords going forward. Or gracefully force a new password for everyone, if circumstances permit that (circumstances including decision making authority; if you are the new CTO or CISO, and you're paranoid about reviewing the existing hashes, you should strongly consider the batched graceful forced reset!) You can set a flag on login to use the password in memory rather than stored.

That's how you get the whole company to love you as a new CTO - force everyone to change their password, including people who have a strong non-reused password.

We’re evaluating different options in this thread. The right move is based on the circumstances and your judgement. I would support a new leader with the courage to close a security hole, maybe respect them even if I don’t love them.

By the way, I don’t feel paranoid to flag bad passwords on login (perhaps triggering an email OTP and forcing a password reset), personally. I responded to this thread because a commenter made an unfounded implication about using HIBP data to reduce vulnerability to credential stuffing.

Re: A decade of Have I Been Pwned

#108

Post by 1vuio0pswjnm7 »

rockskon wrote: post #51
adameasterling wrote: post #19

Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from crede…

About a decade back, I was at an event that had an FBI employee presenting. During his presentation, he had mentioned a story of a sys admin who had been arrested for taking a hashed PW database in his company, comparing the hashes against known compromised one's (perhaps from haveibeenpwned?), and forced a password reset for everyone who had reused a password that had separately been compromised and sent an email to…

Would it matter which hash function was used to create the password database.

But there's more than just the issue of discovering the passowrd itself.

What about the issue of discovering that a particular password hash comes from an employee at a certain company.

As I understand it, Tory Hunt downloads dumps of stolen passwords. He does not share the dumps. Instead he collects queries, like a search engine. Until people start sending him queries of hashes to check he does not necessarily know the locations of the people whose passwords were stolen.

However if he gets a series of hashes sent from some IP address belonging to a perticular corporation, then argubaly he now knows these are likely to be passwords belonging to employees at that corporation.

Re: A decade of Have I Been Pwned

#109

Post by aaronharnly »

eganist wrote: post #104
Sephr wrote: post #76

I have memories of this site providing me with an excellent experience. Now it's just a cash-grab, asking for $169.50/year just to see 100 breached accounts! I use unique email addresses (breach canaries) on every website to detect when sites leak my data. When I tried to search for my domain results with a previous domain ownership verification, I got hit with this error: "In order to search a domain with any more t…

Encountered the same. My hope is that there's a pricing scheme for people like us; may be worth reaching out.

I’m in the same boat — not a company, just an individual doing the separate-email-per-site thing.

(UPDATE): I’ve posted a suggestion to the UserVoice community, which it appears Troy actively monitors.

If the several (dozens?) of us with this use case upvote it, it may catch his attention.

https://haveibeenpwned.uservoice.com/forums/275398-general/s...

Re: A decade of Have I Been Pwned

#110

Post by PeterisP »

mike_d wrote: post #10

It is worth noting the user awareness impact HaveIBeenPwned has had. On the other hand, I feel like SpyCloud does not get enough credit for having a dataset 30x bigger and working directly with companies to actually mitigate credential reuse. If you've ever been prompted at login to a major website or received an email asking you to reset a password because it was used in multiple places, there is a good chance SpyCl…

I'd bet that SpyCloud has less customers than the number of people who have integrated Troy's free pwned password data to actually mitigate password reuse.
Post reply on HN