Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

161–170 of 470 posts

Re: Two billion email addresses were exposed

#161

Post by TZubiri »

jimmar wrote: post #50

I respect Troy Hunt's work. I searched for my email address on https://haveibeenpwned.com/ , and my email was in the latest breach data set. But the site does not give me any way to take action. haveibeenpwned knows what passwords were breached, the people who breached the data knows what passwords were breached, but there does not seem to be any way for _me_, the person affected, to know what password were breached.…

What? You expect the guy to tell you your password? Lol, lmao even.

I know roughly what passwords were exposed because either I remember it, or the date of the leak or the associated email.

I know simple passwords are almost public and that leaks of say linkedin will be properly hashed, while a vb forum from 2006 might not be.

Re: Two billion email addresses were exposed

#162

Post by TZubiri »

smokel wrote: post #100
sunaookami wrote: post #77

Earlier quoted context omitted.

HaveIBeenPwned has been around for ages and it does not send your password to the server - you can check it with the browser console. It hashes it, sends a range of the hash to the server, server replies with a list of hashes that match that range and it's checked locally for a match.

Still, I would not trust that. The password could be leaked through other means, for example by setting a timer, and exfiltrating fragments of it across future requests. The website loads some external fonts and spits out many warnings in the console by default. Does not instill confidence in the truly paranoid hacker.

That level of care is warranted, but you'll find that you are given the tools to audit and it will pass.

Re: Two billion email addresses were exposed

#163

Post by giobox »

digisign wrote: post #118
giobox wrote: post #63

Earlier quoted context omitted.

One of the drawbacks of using a custom domain for personal email is you essentially have to pay for it for life, otherwise anyone can just buy your old email address if the domain expires and start receiving mail, resetting accounts... I think some folks don't fully consider this consequence when setting up a fun vanity email address or similar etc, especially now both iCloud and gmail have made it so trivial to link…

Accounts can most often be closed or deleted permanently when one wants to stop or move. Some can change your address.

Speaking for myself, the "blast radius" of my email address is some 600+ accounts... (just looking in my password manager). The chances of me sitting down and closing every single one are non-existent. Many won't even have the luxury of having diligently tracked their login accounts in a password manager either.

Just having a family, kids, bills, schools, jobs, credit cards, banks, investments, insurance, shopping etc etc - the number of accounts many of us pick up can easily get into the hundreds.

Re: Two billion email addresses were exposed

#164

Post by bdcravens »

junon wrote: post #53
jimmar wrote: post #50

I respect Troy Hunt's work. I searched for my email address on https://haveibeenpwned.com/ , and my email was in the latest breach data set. But the site does not give me any way to take action. haveibeenpwned knows what passwords were breached, the people who breached the data knows what passwords were breached, but there does not seem to be any way for _me_, the person affected, to know what password were breached.…

https://haveibeenpwned.com/Passwords

I was trying random phrases just out of curiosity, and couldn't help but chuckle when it said "epsteinfiles" wasn't found :-)

Re: Two billion email addresses were exposed

#165

Post by drexlspivey »

smokel wrote: post #100
sunaookami wrote: post #77

Earlier quoted context omitted.

HaveIBeenPwned has been around for ages and it does not send your password to the server - you can check it with the browser console. It hashes it, sends a range of the hash to the server, server replies with a list of hashes that match that range and it's checked locally for a match.

Still, I would not trust that. The password could be leaked through other means, for example by setting a timer, and exfiltrating fragments of it across future requests. The website loads some external fonts and spits out many warnings in the console by default. Does not instill confidence in the truly paranoid hacker.

You can hash yourself and check against the api with 5 lines of python

Re: Two billion email addresses were exposed

#166

Post by TZubiri »

worldfoodgood wrote: post #5

The downside to having many vanity urls and giving out a unique email address to each website you visit is that you cannot use haveibeenpwned without paying (despite being a single human). I have no idea how many email addresses I've given out over the years, probably hundreds across at least 6 or 7 domains, and they want to charge me a monthly fee to see which of those have been pwned. I understand they gotta make a…

You need a domain, and possibly a paid mail provider with catch all support.

So cost was always part of this strategy

Re: Two billion email addresses were exposed

#167

Post by smsm42 »

teekert wrote: post #108
eyeundersand wrote: post #46

Earlier quoted context omitted.

+1 for Bitwarden. It is literally the best solution out there. Been getting to increase uptake in personal circles with (very) limited success. The wife keeps trying to convince me that the ship has sailed in trying to protect info online. She's probably right.

I switched from Bitwarden to Proton pass (because we got Proton family) and I find to be equally good. Ineven find sharing credentials a bit easier as it does not require organizations, you can just share with individuals. Proton also has a separate 2fa totp app.

Bitwarden supports TOTP too, even though it's not entirely obvious from the UI.

Re: Two billion email addresses were exposed

#168

Post by jnrk »

troyvit wrote: post #98
stronglikedan wrote: post #78

Earlier quoted context omitted.

> Bitwarden Best when paid for so you can do 2FA with TOTP codes!

I self-host through Vaultwarden but I think I miss this. Besides, I feel like paying these guys anyway just for the great product. We use 1Password at $dayjob and it's so primitive by comparison.

Really? I find it to be the complete opposite.

Re: Two billion email addresses were exposed

#169

Post by smsm42 »

stronglikedan wrote: post #78
eyeundersand wrote: post #46

Earlier quoted context omitted.

+1 for Bitwarden. It is literally the best solution out there. Been getting to increase uptake in personal circles with (very) limited success. The wife keeps trying to convince me that the ship has sailed in trying to protect info online. She's probably right.

> Bitwarden Best when paid for so you can do 2FA with TOTP codes!

It costs $10/year, so there's really no reason to not pay for it.

Re: Two billion email addresses were exposed

#170

Post by smsm42 »

rdl wrote: post #86
kulahan wrote: post #45

Earlier quoted context omitted.

I was in the military. China stole my freaking DNA profile . I've given up on worrying about this stuff.

Even better "please give us all the things which could be used by a foreign power to blackmail you, or apply pressure to relatives or other close contacts" and then poorly secure that database.

Those are the same guys who told us we must give them backdoor keys to every encryption algorithm, because nothing can go wrong with it and otherwise terrorists win.
Post reply on HN