Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

61–70 of 470 posts

Re: Two billion email addresses were exposed

#61

Post by guelo »

worldfoodgood wrote: post #5

The downside to having many vanity urls and giving out a unique email address to each website you visit is that you cannot use haveibeenpwned without paying (despite being a single human). I have no idea how many email addresses I've given out over the years, probably hundreds across at least 6 or 7 domains, and they want to charge me a monthly fee to see which of those have been pwned. I understand they gotta make a…

I have the more typical one email used with hundreds of passwords on many websites. haveibeenpwned is also useless for me, it will tell me that my email was compromised but not which sites or passwords. I guess I could check each password individually, hope each password is globally unique to me, and then try to match it back to the website where I used it so I can change the password.

Re: Two billion email addresses were exposed

#62

Post by animex »

kccqzy wrote: post #36
naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

Addresses? Most of the time addresses are a matter of public record. I have used https://www.fastpeoplesearch.com/ a couple of times to search for people's addresses and it really works. One day a close friend excitedly told me she bought a new house and I told her the address before she told me about it. Telephone number? There used to be phone books. And I still instinctively think they should be public.

I think the headline is a bit vague, it includes passwords as well. Does anyone know if Troy's HIBP'd site reveals the passwords to verified users? I'd like to know if my current or what generation of passwords has been breached to evaluate if I have a current or past problem with my devices.

Re: Two billion email addresses were exposed

#63

Post by giobox »

imgabe wrote: post #9

My data was exposed in one of the Facebook leaks and it turned out I had an old email on my Facebook account with a domain I had since let lapse and abandoned. Someone else registered the domain and tried to take over my Facebook account by sending a password reset request using it. Luckily I had 2FA and I guess Facebook's fraud alerts picked it up so It wasn't successful. I guess what I want to say is beware that ev…

One of the drawbacks of using a custom domain for personal email is you essentially have to pay for it for life, otherwise anyone can just buy your old email address if the domain expires and start receiving mail, resetting accounts... I think some folks don't fully consider this consequence when setting up a fun vanity email address or similar etc, especially now both iCloud and gmail have made it so trivial to link a custom domain.

Re: Two billion email addresses were exposed

#64

Post by bigbuppo »

eckesicle wrote: post #41

Is there any real drawback to just never giving your real name or address to service providers to minimise the chance of identity theft? Most likely it’s against terms of service, but other than account suspension are you likely to suffer any legal consequences?

The ad tech companies can associate any fake identity with your real identity. So no, there is no problem. Good thing that all ad tech companies are fully on the up-and-up and have never been compromised to spread malware.

Re: Two billion email addresses were exposed

#66

Post by EvanAnderson »

osculum wrote: post #52
EvanAnderson wrote: post #42

Earlier quoted context omitted.

It tells you that an address in your domain has been included in a breach. It doesn't tell you which address was included. That's what the OP and I are opining about.

It does. I just checked mine today. I can see exactly which individual email addresses in my domain where exposed and in which data leak. I have never paid for it.

Interesting. I'd love to see where you're seeing that. I'll go poke at the site a little more.

Edit: When I try to do a domain search I get told:

> Domain search restricted: You don't have an active subscription so you're limited to searching domains with up to 10 breached addresses (excluding addresses in spam lists).

My domain has 11 breached addresses.

Re: Two billion email addresses were exposed

#67

Post by Aurornis »

eckesicle wrote: post #41

Is there any real drawback to just never giving your real name or address to service providers to minimise the chance of identity theft? Most likely it’s against terms of service, but other than account suspension are you likely to suffer any legal consequences?

Service providers generally use your name and address to validate your billing method.

If you can pay by some method that doesn’t require name or address then go ahead and use a fake name.

Re: Two billion email addresses were exposed

#68

Post by legitster »

rkagerer wrote: post #48

The bit at the end about email deliverability was also interesting: Notifying our subscribers is another problem... in terms of not ending up on a reputation naughty list or having mail throttled by the receiving server .... Not such a biggy for sending breach notices, but a major problem for people trying to sign into their dashboard who can no longer receive the email with the "magic" link. And this observation he…

This is also known as "warming a domain" in the email world. A large rush of emails from an email server is an indicator of a hack or takeover, so anti-spam software may flag an IP address that surges in activity.

Re: Two billion email addresses were exposed

#69

Post by rkagerer »

eckesicle wrote: post #41

Is there any real drawback to just never giving your real name or address to service providers to minimise the chance of identity theft? Most likely it’s against terms of service, but other than account suspension are you likely to suffer any legal consequences?

Anonimity on the Internet is going out of vogue.

The only way to fix the ToS issue you raised is through regulation protecting it.

Unfortunately we're going the other direction, with efforts like verified ID gaining traction in some parts of the world.

It's ironic because in most cases anonymity (or allowing an alternate identity that has its own built-up reputation) would offer real protection, while the verification systems are arguably security theatre.

I don't care what technical genius is built into your architecture, as soon as you force a user to plug their ID information into it, they've forked over control along with any agency to protect their own safety.

Re: Two billion email addresses were exposed

#70

Post by jolmg »

ekjhgkejhgk wrote: post #60
junon wrote: post #53

Earlier quoted context omitted.

https://haveibeenpwned.com/Passwords

[flagged]

> Passwords are protected with an anonymity model, so we never see them (it's processed in the browser itself), but if you're wary, just check old ones you may suspect.

That could mean one might be able to disconnect from the internet while checking.

Post reply on HN