Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

31–40 of 470 posts

Re: Two billion email addresses were exposed

#31

Post by naet »

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even counting the "legal" big data /analytics collected from past social media, Internet browsing, and whatever else.

I now use strong passwords stored in bitwarden to try to at least keep on top of that one piece. I'm sure there are unfortunately random old accounts on services I don't use anymore with compromised passwords out there.

Not really sure what if anything can be done at this point. I wish my info wasn't out there but it is.

Re: Two billion email addresses were exposed

#33

Post by kccqzy »

worldfoodgood wrote: post #5

The downside to having many vanity urls and giving out a unique email address to each website you visit is that you cannot use haveibeenpwned without paying (despite being a single human). I have no idea how many email addresses I've given out over the years, probably hundreds across at least 6 or 7 domains, and they want to charge me a monthly fee to see which of those have been pwned. I understand they gotta make a…

The domain search feature on haveibeenpwned is/was free. I registered my domain on haveibeenpwned back in 2017 and I got two emails about breaches, one in 2020 and another in 2022. I did not pay.

Re: Two billion email addresses were exposed

#35

Post by clickety_clack »

zwnow wrote: post #11

Can anyone enlighten me why an exposed email address is an issue? I get it if its some kinda admin@foo.com but my private mail, why would I care? Its not like they have my password?

It’s not the email address itself that’s important, it’s that the email address is a key identifying users in data breaches. The email addresses are presumably linked to breaches of pii or passwords etc.

Re: Two billion email addresses were exposed

#36

Post by kccqzy »

naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

Addresses? Most of the time addresses are a matter of public record. I have used https://www.fastpeoplesearch.com/ a couple of times to search for people's addresses and it really works. One day a close friend excitedly told me she bought a new house and I told her the address before she told me about it.

Telephone number? There used to be phone books. And I still instinctively think they should be public.

Re: Two billion email addresses were exposed

#37

Post by [deleted] »

worldfoodgood wrote: post #5

The downside to having many vanity urls and giving out a unique email address to each website you visit is that you cannot use haveibeenpwned without paying (despite being a single human). I have no idea how many email addresses I've given out over the years, probably hundreds across at least 6 or 7 domains, and they want to charge me a monthly fee to see which of those have been pwned. I understand they gotta make a…

[deleted]

Re: Two billion email addresses were exposed

#38

Post by hypeatei »

Cynicism is everywhere these days but these events really don't register for me anymore. Companies aren't punished by the government for these leaks and they aren't punished by consumers either. What incentive is there to reduce this data collection in the first place or to lock down your databases?

Even if someone's security is awful as the consumer and their account gets hacked because of these leaks, what are the actual consequences of that? Oh bummer, they need to reset their password and make a few phone calls to their bank to reverse the fraudulent charges then life goes on. Techies view that as unacceptable but most don't really care.

Re: Two billion email addresses were exposed

#39

Post by mbesto »

gausswho wrote: post #2

Amidst all of these pwnings, we still don't have a standard way to update our passwords from our password managers automatically.

Passkeys essentially solve this, however they are not backwards compatible. If they were backwards compatible (e.g. an automated way to change passwords) then you might as well just enable Passkey as a replacement. Thats the conundrum.

Re: Two billion email addresses were exposed

#40

Post by EvanAnderson »

warkdarrior wrote: post #22
EvanAnderson wrote: post #10

Earlier quoted context omitted.

I'm in the same boat. I track all of the unique addresses I use (via my password manager) so I guess I could just check them all against HiBP's database. Kind of a pain in the ass, though.

My password manager (Bitwarden) does that automatically.

I use Bitwarden with a Vaultwarden server so I have some familiarity. Bitwarden checks new passwords against HiBP. I'm not aware of functionality where it can retroactively check old email addresses or passwords to see if they're included in a breach.
Post reply on HN