Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I Been Pwned 2.0

troyhunt.com

Post reply on HN
Print view View original

51–60 of 323 posts

Re: Have I Been Pwned 2.0

#51

Post by malfist »

bongodongobob wrote: post #45
fwip wrote: post #27

Earlier quoted context omitted.

LinkedIn isn't old enough to have anything ancient. It was launched in 2003, and even then you'd get laughed at for suggesting storing passwords in plaintext.

Doesn't mean that the infra is still ancient. What I see a lot is tech debt from migrations. Lots of times both the old and new systems have to work together for a period of time, so you leave certain legacy protocols and flags in place for the transition period and then the new system is never fully "updated" to the new standards. Pre win2k AD, file path lengths, encryption protocols, etc etc. Sure, the new system i…

This is also how feature flag services become mission critical because everything gets launched behind feature flags that never get cleaned up

Re: Have I Been Pwned 2.0

#52

Post by GuinansEyebrows »

Avicebron wrote: post #38
nyokodo wrote: post #34

Earlier quoted context omitted.

> do direct deposits to many millions of people, every time there's new settlements paid I wish I could easily donate my tiny settlements to a good cause. It might make it worth the time to register for the class.

Probably impossible, but create a slush fund where companies that behave badly are forced to pay into so we can do things like fix roads and build housing.

HN Invents Taxes And Fines

Re: Have I Been Pwned 2.0

#53

Post by montag »

diggan wrote: post #31

Who has the record for being in the most breaches? My main email seems to currently be in 40 breaches, earliest one in from June 2011 (HackForums, don't even remember what that is), and last one in September 2024 (FrenchCitizens, although I'm not French nor have I ever lived in France).

You’ve got me beat by 1. Congratulations

Re: Have I Been Pwned 2.0

#54

Post by [deleted] »

hoseyor wrote: post #47
AdamH12113 wrote: post #9

Amazing that even within the last decade a site as large as LinkedIn could be storing unsalted passwords. How does anyone fail at this in the modern era?

For all the talk of AI Slop, I don’t hear much about the fact that we have been suffering from Outsourced Slop for decades now. I suspect that is how this kind of thing also fail at LinkedIn. I say that based on my experience dealing with outsourcing companies and the product they produce through outsourced programmers. It’s really just been a similar problem as with AI code, that without strong and competent managem…

[deleted]

Re: Have I Been Pwned 2.0

#55

Post by gruez »

hx8 wrote: post #44
idiotsecant wrote: post #39

Earlier quoted context omitted.

Wow I think you just launched a political party I would vote for

Fine companies to fund bridges.

That sounds like a great slogan, but you really don't want a justice system that's has an additional mandate to collect revenue. It's basically civil forfeiture all over again

Re: Have I Been Pwned 2.0

#56

Post by miki123211 »

AdamH12113 wrote: post #9

Amazing that even within the last decade a site as large as LinkedIn could be storing unsalted passwords. How does anyone fail at this in the modern era?

It's actually really easy to do unintentionally. For an intervening middleware, a password field in a JSON object is just like any other field in a JSON object.

You may have some kind of logging / tracking / analytics somewhere that logs request bodies. You don't even have to engage in marketing shenanigans for that to be a problem, an abuse prevention system (which is definitely a necessity at their scale) is enough.

Storing unsalted passwords in the "passwords database" is uncommon. Storing request logs from e.g. the Android app's API gateway, and forgetting to mark the `password` field in the forgot password flow as sensitive? Not so uncommon.

Re: Have I Been Pwned 2.0

#57

Post by tylerflick »

idiotsecant wrote: post #39
Avicebron wrote: post #38

Earlier quoted context omitted.

Probably impossible, but create a slush fund where companies that behave badly are forced to pay into so we can do things like fix roads and build housing.

Wow I think you just launched a political party I would vote for

We shall call it the Turtle Party, inspired by the Turtle Religion. Turtles all the way down.

Re: Have I Been Pwned 2.0

#58

Post by Casteil »

CobrastanJorji wrote: post #21

Very cool. Small bug report: I've been pwnd a few dozens times, and my timeline is not in calendar order. I see Adobe (October 2013), then LinkedIn (May 2012), then Dropbox (June 2012), then Lastfm (March 2012), then some 2016 ones, then Kickstarter in 2014, and then after that they start being more in order of the listed dates.

Might be related to the 'breach disclosed/discovered' date? I noticed some of mine appeared out of chronological order, too.

Re: Have I Been Pwned 2.0

#60

Post by mulmen »

Avicebron wrote: post #38
nyokodo wrote: post #34

Earlier quoted context omitted.

> do direct deposits to many millions of people, every time there's new settlements paid I wish I could easily donate my tiny settlements to a good cause. It might make it worth the time to register for the class.

Probably impossible, but create a slush fund where companies that behave badly are forced to pay into so we can do things like fix roads and build housing.

The idea of fines as a revenue stream has never sat well with me. Fines are meant to be a disincentive. The ideal collection amount is zero. Treating them as a revenue stream creates a perverse incentive to enforce the penalty without disincentivizing the behavior.
Post reply on HN