Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

141–150 of 470 posts

Re: Two billion email addresses were exposed

#141

Post by zahlman »

AlienRobot wrote: post #115
junon wrote: post #53

Earlier quoted context omitted.

https://haveibeenpwned.com/Passwords

my password: 2,408 password: 46,628,605 your password: 609 good password: 22 long password: 2 secure password: 317 safe password: 29 bad password: 86 this password sucks: 1 i hate this website: 16 username: 83,569 my username: 4 your username: 1 let me login: 0 admin: 41,072,830 abcdef: 873,564 abcdef1: 147,103 abcdef!: 4,109 abcdef1!: 1,401 123456: 179,863,340 hunter2: 50,474 correct horse battery staple: 384 Correc…

> all your base are belong to us: 1

Only 1, really?

Re: Two billion email addresses were exposed

#142

Post by anonu »

> we run on Azure SQL Hyperscale, which we maxed out at 80 cores for almost two weeks

the data challenge is interesting here. there's clearly a lot of data - but really its just emails and passwords you need to keep track of. SQL feels like overkill that will be too slow and cost you too much. are there better solutions?

15 billion records of email+password, assume ~40bytes thats roughly 600GB

should be searchable with a an off-the-shelf server.

of course, im oversimplifying the problem. but I'm not clear why any solution to insert new records would take 2 weeks...

Re: Two billion email addresses were exposed

#143

Post by esnard »

neogodless wrote: post #123
naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

I use unique email addresses per domain name, and I believe IHaveBeenPwned shows me at 39 unique email addresses breached! (So many that seeing which ones have been breached would now cost me $22 / month... IHaveBeenPwned is starting to feel like an extortion racket of its own..)

If you're using the same domain for each of your email address, HIBP has a domain-wide search feature which is free (but you need to register to validate your domain)

Re: Two billion email addresses were exposed

#144

Post by MattSteelblade »

gretch wrote: post #30
zkmon wrote: post #18

I think we should stop seeing email address as a secret or something that can be "stolen". Password? who is still storing passwords on their servers, instead of a hash?

Given enough time, hashes are reversible via brute force. If the attacker steals the entire password table undetected, they have a large amount of time to generate soft collisions. After all they don’t need to hack any particular account, just some 50% of the accounts. The time can be increased by some coefficient via salting, but the principles remain the same.

For password hashing, only short-output or broken hash functions have practical collision concerns. The odds of any random collision with a 256-bit hash, and not with a specific hash, is 50% at 2^128 inputs. Salting is a defense against precomputation attacks like rainbow tables and masking password reuse. Attackers crack password dumps by trying known password combinations, previously compromised passwords, brute force up to a certain length, etc. and using the hashing algorithm to compare the output.

Re: Two billion email addresses were exposed

#145

Post by zahlman »

esnard wrote: post #138
zahlman wrote: post #126

Earlier quoted context omitted.

Second line I already notice: > 000F6468C6E4D09C0C239A4C2769501B3DD:5894 ... Does the 5894 mean what I think it does?

5894 means that the password appeared 5894 times in the dataset. 5894 is not the password associated with the hash.

Yes, it did mean what I thought, then.

But I guess some passwords appear far more often than that in the dataset.

Re: Two billion email addresses were exposed

#146

Post by frankdvn »

sloped wrote: post #107

I switched to using masked emails with Fastmail primarily so I could see who sold my data. The potential security benefit was not really a driver. Having 1Password be able to generate a unique email makes it a no-brainer these days. For those services that require a username that is not your email, they can usually be used without the domain part. Works really well. I even wrote a tiny little local only web app that…

I just learned that FastMail provides an iOS shortcut to "Create Masked Email".

Just be careful, you must press Save after or else you'll lose it.

Re: Two billion email addresses were exposed

#147

Post by magackame »

elwebmaster wrote: post #128

Why are we still using passwords? Why can’t all login be done with asymmetric keys: your public keys are stored on the server, your private keys on the device. Carry a backup pair on your USB and treat it as a key to your house. Any of them got lost? Just delete the respective public key from the service.

That's passkeys. Google and Microsoft are pushing in that direction.

Re: Two billion email addresses were exposed

#148

Post by jorams »

This seems to include details from a Spotify data breach in or before early 2020 that, to my knowledge, was never reported on. They did have other, similar issues that year.

Reporting from the time seems to all be about one or multiple leaks/attacks involving:

- Credential stuffing with data from other breaches

- A leak of data (including email addresses) to "certain business partners" between April 9, 2020 and November 12, 2020.

On April 2, 2020 somebody logged in to my Spotify account (which had a very weak password) from a US IP address. This account used an email address only ever used to sign up to Spotify years earlier, and the account had been unused for years by that point. I changed the password minutes later. A few hours after that Spotify also sent an automatic password reset because of "suspicious activity". At no point have I ever been notified by Spotify that my data had been leaked, though it obviously had, and now said email finally shows up on HIBP.

Re: Two billion email addresses were exposed

#149

Post by ChrisMarshallNY »

I think, at this point, we should just assume that our emails are out there. Can't put the candy back in the piñata.

My main email addy is an OG mac.com address. I registered it about five minutes after Steve announced it. My wife got her first name, but I suspect that Chris Espinosa already had chris@mac.com.

In any case, it was compromised back when Network Solutions sold their database to spammers (or some other scumbags sold their database), and it's been feral, ever since. Basically, most of this century.

I've survived it. I maintain Inbox Zero, frequently.

One of the saving graces, is that mac.com has "aged out," so most of the spammers switched over to icloud.com, and that means I can just set up a rule to bin anything that comes into icloud.com.

Re: Two billion email addresses were exposed

#150

Post by pixxel »

teekert wrote: post #108
eyeundersand wrote: post #46

Earlier quoted context omitted.

+1 for Bitwarden. It is literally the best solution out there. Been getting to increase uptake in personal circles with (very) limited success. The wife keeps trying to convince me that the ship has sailed in trying to protect info online. She's probably right.

I switched from Bitwarden to Proton pass (because we got Proton family) and I find to be equally good. Ineven find sharing credentials a bit easier as it does not require organizations, you can just share with individuals. Proton also has a separate 2fa totp app.

[dead]
Post reply on HN