Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

21–30 of 470 posts

Re: Two billion email addresses were exposed

#21

Post by santiagobasulto »

zwnow wrote: post #11

Can anyone enlighten me why an exposed email address is an issue? I get it if its some kinda admin@foo.com but my private mail, why would I care? Its not like they have my password?

Could leave to massive impersonation attempts. All the folks here on HN are probably very tech savvy, so we’ll likely have a strong password + 2FA. But mom and pops that just got their email addresses leaked? Probably not. So they might start just trying out a rainbow table of common passwords and getting access to peoples emails. Once you’re there getting to home banking and other privileged resources is not hard.

Re: Two billion email addresses were exposed

#22

Post by warkdarrior »

EvanAnderson wrote: post #10
worldfoodgood wrote: post #5

The downside to having many vanity urls and giving out a unique email address to each website you visit is that you cannot use haveibeenpwned without paying (despite being a single human). I have no idea how many email addresses I've given out over the years, probably hundreds across at least 6 or 7 domains, and they want to charge me a monthly fee to see which of those have been pwned. I understand they gotta make a…

I'm in the same boat. I track all of the unique addresses I use (via my password manager) so I guess I could just check them all against HiBP's database. Kind of a pain in the ass, though.

My password manager (Bitwarden) does that automatically.

Re: Two billion email addresses were exposed

#24

Post by esafak »

imgabe wrote: post #9

My data was exposed in one of the Facebook leaks and it turned out I had an old email on my Facebook account with a domain I had since let lapse and abandoned. Someone else registered the domain and tried to take over my Facebook account by sending a password reset request using it. Luckily I had 2FA and I guess Facebook's fraud alerts picked it up so It wasn't successful. I guess what I want to say is beware that ev…

What a lot of work to capture one account.

Re: Two billion email addresses were exposed

#26

Post by dpoloncsak »

worldfoodgood wrote: post #16
huijzer wrote: post #13

Earlier quoted context omitted.

Isn’t the idea that you don’t need haveibeenpowned since you’ll see mails coming in and then know your details have leaked? For ID fraud, more than an email address has to be leaked.

Have I been pwned will tell me if the associated password for that site leaked. I create unique passwords per site, but lets say my mastercard login gets pwned -- that'd be one I want to change the password for right away. I might not get an email if someone gets that account info.

In theory, I agree.

In practice, anything that high-profile will be plastered all over every tech news site, twitter, reddit, probably even the news. It would be difficult for MasterCard/Visa to have dataleaks, even just email/pass, fly under the radar (I imagine...)

Oracle tried to cover up a data leak, and it didn't go great. Oracle touches nowhere near as many every-day people as MasterCard does

Re: Two billion email addresses were exposed

#27

Post by zwnow »

worldfoodgood wrote: post #20
zwnow wrote: post #11

Can anyone enlighten me why an exposed email address is an issue? I get it if its some kinda admin@foo.com but my private mail, why would I care? Its not like they have my password?

> Oh - and 1.3 billion unique passwords, 625 million of which we'd never seen before either. It's not just email addresses. It's address + password combos. But also, how did 2 billion email addresses get exposed? Assuming I give an email address to a company (and only that company) if someone gets access to that email addresss they either got it from me or that company. Knowing the company has sold, lost, or poorly p…

Yea a combo is more problemtic, I could see why thats an issue. Most important stuff in my life has 2FA with my phone thankfully. My banking password got breached like 3 years ago and i still didnt change it... nothing ever happened. I am guessing tech companies that could have huge negative influence on your life should have additional security measures in place, like not allowing a login from a different country unless some kinda mobile code is provided or stuff like that. I'm pretty naive with all that tbh.

Re: Two billion email addresses were exposed

#28

Post by elorant »

zwnow wrote: post #11

Can anyone enlighten me why an exposed email address is an issue? I get it if its some kinda admin@foo.com but my private mail, why would I care? Its not like they have my password?

One reason is spam. The other is that in many cases passwords are leaked too.

Re: Two billion email addresses were exposed

#30

Post by gretch »

zkmon wrote: post #18

I think we should stop seeing email address as a secret or something that can be "stolen". Password? who is still storing passwords on their servers, instead of a hash?

Given enough time, hashes are reversible via brute force.

If the attacker steals the entire password table undetected, they have a large amount of time to generate soft collisions. After all they don’t need to hack any particular account, just some 50% of the accounts.

The time can be increased by some coefficient via salting, but the principles remain the same.

Post reply on HN