Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I Been Pwned 2.0

troyhunt.com

Post reply on HN
Print view View original

131–140 of 323 posts

Re: Have I Been Pwned 2.0

#131

Post by cupofnotjoe »

gerdesj wrote: post #122
paranoidrobot wrote: post #112

Earlier quoted context omitted.

No, he's not. https://www.troyhunt.com/about/ says "I don't work for Microsoft"

"Microsoft Regional Director" We can debate semantics but if you describe yourself with a job title attached to a company then I suggest that you have an association which looks rather like ... employment.

Its not semantics at all, you just are excusing your own misunderstanding. He didn't describe himself with a job title, and he even explicitly states directly after listing those awards, that he is not an employee of Microsoft.

Extending your logic, I have a CCIE, so if I ever state I'm a CCIE, I'm an employee of Cisco? I have a masters degree by coursework from a university, so I I ever state I have an Msc, I'm an employee of the university? I have an electrical licences issued by EnergySafe Victoria, so if I say I'm an A-Grade Electrician, I'm an employee of EnergySafe Victoria?

Re: Have I Been Pwned 2.0

#132

Post by Brajeshwar »

mNovak wrote: post #3

Is there a term for this trend in web design, with defaulting to dark mode and having slick gradients everywhere?

Not too far in the past, when Bootstrapped themes were becoming the face of the Internet, a new framework came to town — TailwindCSS. The smart thing they did was introduced the framework with a few brilliant template and a lot of styled components. I bought the initial copy and does a lot of people. Those templates, TailwindUI.com (now TailwindCSS.com/plus)[1] became the gradien-y, dark-ish, glow-y design you see a lot these days.

A similar design wave is also happening with internal dashboard, admin interfaces. Thanks to https://ui.shadcn.com Personally, I'm fine with the standardization of such functional interface designs.

btw, for Have I Been Pwned, this is Bootstrap[2] and I'm not surprised it is also inheriting those design styles.

1. https://tailwindcss.com/plus

2. https://getbootstrap.com

Re: Have I Been Pwned 2.0

#133

Post by recursivegirth »

GuinansEyebrows wrote: post #52
Avicebron wrote: post #38

Earlier quoted context omitted.

Probably impossible, but create a slush fund where companies that behave badly are forced to pay into so we can do things like fix roads and build housing.

HN Invents Taxes And Fines

So what we are really saying is that we should form a new government?

Re: Have I Been Pwned 2.0

#134

Post by eddythompson80 »

coolcase wrote: post #124
YPPH wrote: post #37

For those who would prefer to stay a little more under the radar, you can hide results from a search of your email appearing on this service. https://haveibeenpwned.com/OptOut

What if the opt out list gets pwned?

I assume if that ever happens, someone will register https://haveibeenpwnedbyhaveibeenpwned.com. It'll be the top post of HN for a couple of says while everyone argues in the comments about how the state of online security is "fundamentally broken" while someone asks if they can sue. Then we'll all forget and move on.

Re: Have I Been Pwned 2.0

#135

Post by gleenn »

_heimdall wrote: post #90
Avicebron wrote: post #38

Earlier quoted context omitted.

Probably impossible, but create a slush fund where companies that behave badly are forced to pay into so we can do things like fix roads and build housing.

We could also design some kind of electoral process for picking those in charge of defining the rules and creating yet more bodies to enforce it. Maybe this time we can come up with a better way to disincentivize corruption and bribery.

So on the nose. We shouldn't have to wait for pennies from lawsuits to have good roads and adequate housing

Re: Have I Been Pwned 2.0

#136

Post by BrenBarn »

throwaway8eor wrote: post #64
neilv wrote: post #22

He should partner with a law firm, for class action lawsuits, for every breach due to negligence (which is probably all of them). Tie in to a banking service, so you can do direct deposits to many millions of people, every time there's new settlements paid, and you'll be a folk hero. Get lawyers who want negligent companies to actually regret the breaches, with judgements that hurt. (Rather than a small settlement th…

I think this would have a negative effect. Getting a company to publicly announce a breach is hard today. Your suggestion would make it even harder, and more data breaches would be kept from the public because of the consequences. I would rather know that a company messed up and change my password, than not knowing

I'm not sure, the effect would be to increase the riskiness of nondisclosure. If you disclose and get fined, that would be bad, but if you don't reveal and the penalty for nondisclosure is bankruptcy for the company and all its executives, that would be worse.

Re: Have I Been Pwned 2.0

#137

Post by dgfitz »

mcmcmc wrote: post #88
mulmen wrote: post #60

Earlier quoted context omitted.

The idea of fines as a revenue stream has never sat well with me. Fines are meant to be a disincentive. The ideal collection amount is zero. Treating them as a revenue stream creates a perverse incentive to enforce the penalty without disincentivizing the behavior.

If your ideal is a perfect society where everyone follows the all rules all the time you are going to be sorely disappointed. The ideal collection amount is the size of the fine multiplied by the actual occurrence of the offense. And that revenue should be strictly used for rehabilitative or restorative justice. For example, speeding fines should go to road improvements that deter speeding making roads safer. If no o…

> But people will always break the law.

That says a whole lot all by itself. You acknowledge that reform doesn’t work? There is always money to be made because people don’t like the set of rules set? So when people follow all those rules, make new rules that people will break to keep it going? Where does it stop?

Re: Have I Been Pwned 2.0

#138

Post by riknos314 »

taberiand wrote: post #126
miki123211 wrote: post #56

Earlier quoted context omitted.

It's actually really easy to do unintentionally. For an intervening middleware, a password field in a JSON object is just like any other field in a JSON object. You may have some kind of logging / tracking / analytics somewhere that logs request bodies. You don't even have to engage in marketing shenanigans for that to be a problem, an abuse prevention system (which is definitely a necessity at their scale) is enough…

Would this be solved by providing the client with a (frequently rotated) public key to encrypt the password field specifically before submitting to the server, so that the only place it can be decrypted and stored is the authentication service at the very end of its journey through the network?

A new public key per password-mutating session is quite an interesting idea.

It does have some challenges in introducing a read-before-write to fetch the session key at the start of the session, but given the relatively low call volume of such flows that might be a small price to pay to simplify security audits and de-risk changes to any service in the call chain.

Re: Have I Been Pwned 2.0

#140

Post by xyst »

BubbleRings wrote: post #101

I’ve never been able to figure out how haveibeenpwned.com can be useful to me, since I have had the same email address for many years and I don’t want to give it up. Do people get a new primary email address every time their address shows up in a breach list like haveibeenpwned ?

I have my own mail server and setup a catch all alias to a single account. So I can generate -- on the fly -- e-mails for services.

- Apple: me.apple@example.com - Google: me.google@example.com - Uber: me.uber@example.com - Tinder: me.tinder@example.com - random business: me.randombusinessname@example.com

This helps me with the following:

- unique usernames and passwords for each service

- easily able to tell when a service sells my information or gets hacked/breached

- "haveibeenpwned" also allows mail server owners to get access to reports for all addresses on a domain and receive notifications on breaches

- much easier to remember and communicate with others as compared to iCloud hide my e-mail addresses

- on the outgoing/sending, re-writing the "from" address field in e-mails is very easy to do

Post reply on HN