Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I Been Pwned 2.0

troyhunt.com

Post reply on HN
Print view View original

201–210 of 323 posts

Re: Have I Been Pwned 2.0

#201

Post by keybored »

> The AI

> I wanted to make a quick note of this here, as AI seems to be either constantly overblown or denigrated.

This just gestures at middle-of-the-road thinking.

So what’s this begrudging note about? To set us on the correct course in the middle of the road?

> I'd say it was right 90% of the time, too, and if you're not using AI aggressively in your software development work now (and I'm sure there are much better ways, too) I'm pretty confident in saying "you're doing it wrong".

Well done. AI plug done.

I don’t see how that statement fulfills the implied middle-of-the-road opinion though.

Re: Have I Been Pwned 2.0

#202

Post by Aachen »

> It's likely a single-digit percentage of requests that are real humans being [blocked], and we need to look at ways to get that number down, but at least the fallback positions are improved now.

The fallback suggestions mentioned in the article are "try clicking the box again" and "try reloading the page"

I'm slowly starting to wonder if I should start sending snail mail to companies that block me, instead of resigning to go somewhere else. HIBP is a free web service and shops have no obligation to serve a given individual, but it everyone puts CloudFlare Turnstile, Google Recaptcha, etc. in front of their services, a "single-digit percentage" of people simply cannot participate in modern society. Similar markers (IP address misclassified as bot range, unusual/old/infected browser, ...) will constantly be triggering for the same group

Re: Have I Been Pwned 2.0

#203

Post by miki123211 »

jeffparsons wrote: post #62
miki123211 wrote: post #56

Earlier quoted context omitted.

It's actually really easy to do unintentionally. For an intervening middleware, a password field in a JSON object is just like any other field in a JSON object. You may have some kind of logging / tracking / analytics somewhere that logs request bodies. You don't even have to engage in marketing shenanigans for that to be a problem, an abuse prevention system (which is definitely a necessity at their scale) is enough…

A company as big as LinkedIn should have bots continually accessing their site with unique generated passwords etc., and then be searching for those secrets in logging pipelines, bytes on disk, etc. to see where they get leaked. I know much smaller companies that do this. Yes, it's easy to fuck up. But a responsible company implements mitigations. And LinkedIn can absolutely afford to do much more.

Such bots can certainly solve part of the problem, but they can't fix the issue entirely.

If your logging is on an obscure enough endpoint (password reset flow in the Android app's API gateway), you may forget to add that endpoint to the bot, just like you may forget to mark it as sensitive in your logging system.

At this scale, the developers working on these esoteric endpoints might not even be aware that such a bot exists.

Re: Have I Been Pwned 2.0

#204

Post by shmeeed »

marcus_holmes wrote: post #178
jeffparsons wrote: post #62

Earlier quoted context omitted.

A company as big as LinkedIn should have bots continually accessing their site with unique generated passwords etc., and then be searching for those secrets in logging pipelines, bytes on disk, etc. to see where they get leaked. I know much smaller companies that do this. Yes, it's easy to fuck up. But a responsible company implements mitigations. And LinkedIn can absolutely afford to do much more.

I always picture a random middle manager in $large_organisation being told about something like this, and then they work out the angles and try to find the benefit. If the method works, and it shows that the logging feature Fred got so much credit for is storing passwords, what are the political implications of that? Can our intrepid middle manager steal some of Fred's glory? Or is Fred an ally and it should be caref…

Sadly, this is not as far-fetched as we here on HN would like it to be.

Re: Have I Been Pwned 2.0

#205

Post by mschuster91 »

koolba wrote: post #86
diggan wrote: post #33

Earlier quoted context omitted.

> Application specific credit card numbers really needs to be a legally required thing. My latest card (debit) one has a feature I've not seen elsewhere, but I think kind of solves that too. It has a new CVC number every 10 minutes, which I kind of both hate and love. Love it for the obvious reasons of "not even having the physical card lets you use it digitally" but also because I cannot have it 100% in my password…

I’ve want a physical one of these that changes both the CVC and the entire 16-digit number. Heck let the name submitted with the number be a longer checksum that can be verified at point of sale to figure out who’s actual account it is. Plus then my gibberish name on my card number will match the gibberish secret question answers.

> Heck let the name submitted with the number be a longer checksum that can be verified at point of sale to figure out who’s actual account it is.

That's going to be one hell of a lot of an issue in practice. Hotels, car rentals and AFAIK even some airlines want that the name of the card holder matches the name on the ID card.

Re: Have I Been Pwned 2.0

#206

Post by xythobuz »

tenzing wrote: post #200
dmos62 wrote: post #149

Earlier quoted context omitted.

If I drive carelessly and get a meaningful fine, I'll think twice next time, irrespective of who gets the money. I only care that I am fined. Unless the police starts to administer fines when they shouldn't, all is good, right? What happened in Belgium?

That's fine for you personally, and it may sound all good from a logical, theoretical, or academic perspective, however I personally know of people who have lost their license due to multiple fines and "demerit points" (NZ) resulting in that consequence. The fines, and loss of license hurt them personally, professionally, and financially, but didn't change their behavior outside of the very short term. In NZ we have…

Then these people _obviously_ are not fit to drive a multi-ton killing machine at all and should have their license permanently revoked, when they had multiple chances for introspection.

Re: Have I Been Pwned 2.0

#207

Post by dotancohen »

victorbjorklund wrote: post #168
dmos62 wrote: post #149

Earlier quoted context omitted.

If I drive carelessly and get a meaningful fine, I'll think twice next time, irrespective of who gets the money. I only care that I am fined. Unless the police starts to administer fines when they shouldn't, all is good, right? What happened in Belgium?

If they design the road to make it harder to follow the rules it is bad.

Bad for the driver, good for the government. That's exactly the point.

Re: Have I Been Pwned 2.0

#208

Post by diggan »

stevekemp wrote: post #164

Like many people I have a "main" email address, and I use per-company addresses for almost everything else. Now that the domain-searches require subscriptions this site has become much less useful. I just added my domain to the site again and I see "2,243 Total Breached Addresses", and "18 Addresses excluding Spam Lists", but I have no idea what they are. Attempting to click the links shows me I need to "upgrade" to…

I have a similar setup, and also use lots of addresses at one domain. But I'm not subscribed (as far as I know) and I can do a wildcard search at my domain without issues, and also see exactly what emails been leaked. I don't see what leaks they're part of, but that feels less relevant, I already know where it got leaked as each email is for one product/project/company.

Re: Have I Been Pwned 2.0

#209

Post by diggan »

tallanvor wrote: post #177
nikcub wrote: post #63

Lots of regular people use Have I Been Pwned and sending them to 1Password is probably the single best thing you could do for them (I know it's a sponsorship - but it's a very complimentary one). I'd make the language around that promo banner stronger (ie. "We strongly recommend") and make it stand out more on the page. So many social media accounts get hacked[0] because of shared passwords and those affected users o…

It's a sponsorship, so I'm not complaining, but if the goal was really to get people to use a password manager he would be sending them to Bitwarden since they have a free plan, plus their paid plan is only $10/year compared to $36 for 1Password.

Besides the pricing, is there any reason to prefer Bitwarden over 1Password? Been happily using 1Password for some years, never had any issues, but maybe I'm glossing over anything? Probably the cli interface (`op`) is the one feature I couldn't live without today.

Re: Have I Been Pwned 2.0

#210

Post by diggan »

rainonmoon wrote: post #119
MattSayar wrote: post #10

Earlier quoted context omitted.

Makes me feel a little powerless. The only thing I can really do is freeze my credit

Use multi-factor authentication and strong, unique passwords for everything and you'll never have to worry about this.

Wish it was so easy, some websites have decided they like lower security, especially for some reason, my banks. Banc Sabadell in Spain for example, only does 2FA via SMS (famously insecure) and your password is limited to 6 numbers, and accepts nothing else.
Post reply on HN