Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A decade of Have I Been Pwned

troyhunt.com

Post reply on HN
Print view View original

111–120 of 181 posts

Re: A decade of Have I Been Pwned

#111

Post by bigiain »

rockskon wrote: post #57
kranke155 wrote: post #55

Earlier quoted context omitted.

I would love to get a proper source on this. Seems a bit crazy, and wouldn't this be thrown out on appeal?

Unfortunately I have no source to give. The FBI employee was just giving an example of illegal behavior he knew of. He didn't cite jurisdiction or the names of people involved. Hell - even if he did, I likely wouldn't have remembered it as this was roughly 8 years ago I was in the audience for this (I know I said roughly a decade ago in my prior post - but I checked a receipt for the event and it was in 2015).

Quite likely Randal Schwartz.

"In July 1995, Schwartz was prosecuted in the case of State of Oregon vs. Randal Schwartz, which dealt with compromised computer security during his time as a system administrator for Intel. In the process of performing penetration testing, he cracked a number of passwords on Intel's systems. Schwartz was originally convicted on three felony counts, with one reduced to a misdemeanor, but on February 1, 2007, his arrest and conviction records were sealed through an official expungement, and he is legally no longer a felon." -- https://en.wikipedia.org/wiki/Randal_L._Schwartz

Re: A decade of Have I Been Pwned

#112

Post by xboxnolifes »

Vicinity9635 wrote: post #67

Anybody been in more than 20 data breeches? All my stuff's been locked down with a password manager/2fa so I'm not worried, but having been on the internet for ages it's pretty funny at this point.

My childhood-turned-throwaway email has been involved in over 30 breaches according to the site. A lot of them are forum related.

Re: A decade of Have I Been Pwned

#113

Post by pavel_lishin »

uxp8u61q wrote: post #73
CoffeeOnWrite wrote: post #68

Earlier quoted context omitted.

Be satisfied with fixing the new passwords going forward. Or gracefully force a new password for everyone, if circumstances permit that (circumstances including decision making authority; if you are the new CTO or CISO, and you're paranoid about reviewing the existing hashes, you should strongly consider the batched graceful forced reset!) You can set a flag on login to use the password in memory rather than stored.

That's how you get the whole company to love you as a new CTO - force everyone to change their password, including people who have a strong non-reused password.

Your job as a CTO isn't to be loved by the entire company.

Re: A decade of Have I Been Pwned

#114

Post by [deleted] »

aaronharnly wrote: post #109
eganist wrote: post #104

Earlier quoted context omitted.

Encountered the same. My hope is that there's a pricing scheme for people like us; may be worth reaching out.

I’m in the same boat — not a company, just an individual doing the separate-email-per-site thing. (UPDATE): I’ve posted a suggestion to the UserVoice community, which it appears Troy actively monitors. If the several (dozens?) of us with this use case upvote it, it may catch his attention. https://haveibeenpwned.uservoice.com/forums/275398-general/s...

[deleted]

Re: A decade of Have I Been Pwned

#115

Post by mtmail »

agentultra wrote: post #37

Blackmail scammers have been using pwned password databases to craft some pretty convincing phishing emails ("I have installed RAT on your system and have been watching you through your webcam, proof I hacked you: -- send $1800 of BTC to this address and don't go to the police. Maybe use a password manager next time."). Do people get caught in these scams? I assume most get blocked by spam filters. I've only noticed…

A family member called me in distress asking if the email is legic. It had his full postal address and last 4 digits of a credit card (not an old password). People do believe it.

Re: A decade of Have I Been Pwned

#116

Post by paulpauper »

bigstrat2003 wrote: post #96
craignatic wrote: post #21

he shouldn't have mentioned goatse, or told me not to google it. my curious brain took me to a rabbit hole where several times i wished i didnt have eyes.

You get kind of immune to it eventually. At this point I don't even get fazed by goatse, if anything I'm more impressed by just how far that guy managed to stretch.

i never seen it but now inferred enough to know I don't want to

Re: A decade of Have I Been Pwned

#117

Post by CoffeeOnWrite »

KolmogorovComp wrote: post #74
adameasterling wrote: post #19

Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from crede…

> ... and then realize with a horrible feeling that some % of those hits are getting through the login page. (Non sarcastic), why would you feel bad for users using 1234 as their passwords? Unless your website is aimed at vulnerable people, I consider this to be their responsibility. As other comments have said these users will probably go the easiest route (1234websitename) to fix the error. Any restriction you put…

Have you ever operated an online business? Poor password choice is practically harmful to business. Marginal reduction of entropy by blocking breached passwords, what's the practical harm from that?

1234websitename is objectively better than 1234.

I'll go with NIST on this one (yes, and have a minimum length too):

> When processing requests to establish and change memorized secrets, verifiers SHALL compare the prospective secrets against a list that contains values known to be commonly-used, expected, or compromised... If the chosen secret is found in the list, the CSP or verifier SHALL advise the subscriber that they need to select a different secret, SHALL provide the reason for rejection, and SHALL require the subscriber to choose a different value.

https://pages.nist.gov/800-63-3/sp800-63b.html#memsecret

Re: A decade of Have I Been Pwned

#118

Post by paulpauper »

Sephr wrote: post #76

I have memories of this site providing me with an excellent experience. Now it's just a cash-grab, asking for $169.50/year just to see 100 breached accounts! I use unique email addresses (breach canaries) on every website to detect when sites leak my data. When I tried to search for my domain results with a previous domain ownership verification, I got hit with this error: "In order to search a domain with any more t…

another example of "everything as a service". Bullshit freemium model where a service starts out good, and then once they start getting usage: put the functionality behind paywall and degrade the free service to the point of being useless. Facebook, as bad as it is, has not succumbed to this: 'free Facebook' is still as functional as it was in 2010, but more tracking obviously.

Re: A decade of Have I Been Pwned

#119

Post by resonantjacket5 »

vasco wrote: post #91
rockskon wrote: post #57

Earlier quoted context omitted.

Unfortunately I have no source to give. The FBI employee was just giving an example of illegal behavior he knew of. He didn't cite jurisdiction or the names of people involved. Hell - even if he did, I likely wouldn't have remembered it as this was roughly 8 years ago I was in the audience for this (I know I said roughly a decade ago in my prior post - but I checked a receipt for the event and it was in 2015).

Really hard to belief without anything else to go by. This sounds like old wives tales like people that add disclaimers saying they aren't laywers when they comment on the internet because someone once told them they heard someone got in trouble.

Does it sound that unbelievable for the 2010s? There was quite a discrepancy between how the internet/computers were generally being used and the legality.

Like https://www.eff.org/deeplinks/2016/07/ever-use-someone-elses... > Last week, the Ninth Circuit Court of Appeals, in a case called United States v. Nosal, held 2-1 that using someone else’s password, even with their knowledge and permission, is a federal criminal offense.

Also, the courts only just legalized white hacking last year. Before that violating the terms of service was also potentially a federal crime. https://www.spiceworks.com/it-security/security-general/news...

Re: A decade of Have I Been Pwned

#120

Post by paulpauper »

stuckkeys wrote: post #103
Sephr wrote: post #76

I have memories of this site providing me with an excellent experience. Now it's just a cash-grab, asking for $169.50/year just to see 100 breached accounts! I use unique email addresses (breach canaries) on every website to detect when sites leak my data. When I tried to search for my domain results with a previous domain ownership verification, I got hit with this error: "In order to search a domain with any more t…

You can download the DB from the DarkNet and run it locally so you don’t have to pay. The only downside is, you have to manage this db yourself and frequently update it. But it is similar. I have seen lot of these (cash-grab) services pop up offering API DB access for a cost.

this is the way. you never want to alert someone to the fact your address is possibly vulnerable in the first place
Post reply on HN