Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

231–240 of 470 posts

Re: Two billion email addresses were exposed

#231

Post by klardotsh »

CaptainNegative wrote: post #221
smsm42 wrote: post #167

Earlier quoted context omitted.

Bitwarden supports TOTP too, even though it's not entirely obvious from the UI.

TOTP inside a password manager doesn't make much sense to me. What's the point of two factor auth if both factors are stored together?

I don’t know the “correct” answer, but here’s my answer as someone whose TOTP are split across a YubiKey and Bitwarden: I store TOTP in Bitwarden when the 2FA is required and I just want it to shut up. My Vault is already secured with a passphrase and a YubiKey, both of which are required in sequence, and to actually use a cred once the Vault is authenticated, requires a PIN code (assuming the Vault has been unlocked during this run of the browser, otherwise it requires a master password again).

At that point, frankly, I am gaining nearly nothing from external TOTP for most services. If you have access to my Vault, and were able to fill my password from it, I am already so far beyond pwned that it’s not even worth thinking about. My primary goal is now to get the website to stop moaning at me about how badly I need to configure TOTP (and maybe won’t let me use the service until I do). If it’s truly so critical I MUST have another level of auth after my Vault, it needs to be a physical security key anyway.

I was begging every site ever to let me use TOTP a decade ago, and it was still rare. Oh the irony that I now mostly want sites to stop bugging me for multiple factors again.

Re: Two billion email addresses were exposed

#232

Post by [deleted] »

Aeolun wrote: post #196
Koffiepoeder wrote: post #189

Earlier quoted context omitted.

The moment you put TOTP in Bitwarden it is no longer a 'second factor'. Pretty bad security advice to be honest. Better to use hardware tokens or a secure phone (with enclave) instead (never SMS though).

I think it’s mostly nice for places that require TOTP but don’t actually rate carrying around/plugging in a yubikey for.

[deleted]

Re: Two billion email addresses were exposed

#233

Post by antiframe »

Aeolun wrote: post #197
antiframe wrote: post #187

Earlier quoted context omitted.

I have two reasons not to pay for it: 1) Aegis is free. 2) I rather not have my second factor be stored in the same database as my first factor.

You can just not store the TOTP tokens in Bitwarden? I don’t see how this is an argument against.

If I only store passwords in Bitwarden, not TOTP tokens, then I don't have to pay for it. So, it's an argument for spending less money while being more secure.

Re: Two billion email addresses were exposed

#234

Post by edoceo »

naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

Right to be removed/purged and maximum retention policy. One place I'm aware of purges accounts that have been inactive 18month. Historical billing info is offline and "gapped"

Re: Two billion email addresses were exposed

#235

Post by LilBytes »

8cvor6j844qw_d6 wrote: post #225

Anyone have thoughts on Bitwarden / 1Password / Proton Pass? Proton Pass feels too new for me but eagerly awaiting good feedbacks / reviews. However, "don't put all your eggs in one basket" might apply here. Went with Bitwarden instead of 1Password since its open source, and I imagine (in my uninformed opinion) that a larger userbase by being free means more issues might be encountered and ironed out.

1Password is awesome.

I haven't really looked at anything else but I found >2 years ago the UI of BitWarden to be ordinary. And it was more awkward to manage a company.

Went with 1Password in the end, and that you get a free Family account with a Business account is great.

Your position on how BitWarden is open source should contribute to any decision you make though.

Re: Two billion email addresses were exposed

#236

Post by omeletdufromage »

ptrl600 wrote: post #91

Are there any email services which allow basically unlimited aliases with long, random names? I'm using my own domain right now, but that can only uncover who has leaked my data; does not provide additional privacy.

Another commenter mentions ProtonMail, but somewhat unadvertised is with a paid Proton sub (I forget which tier), you also get access to SimpleLogin. It's a service which lets you create new email aliases with your domain that just send them to another email you own. (Also lets you send emails as that alias, so the other end doesn't see your real address.)

I use it with Vault/Bitwarden, which lets me generate email addresses of format `@my.domain.com` when I create new login info for services.

Re: Two billion email addresses were exposed

#237

Post by NetMageSCW »

nagisa wrote: post #193
troyvit wrote: post #98

Earlier quoted context omitted.

I self-host through Vaultwarden but I think I miss this. Besides, I feel like paying these guys anyway just for the great product. We use 1Password at $dayjob and it's so primitive by comparison.

TOTP works with vaultwarden.

1Password supports TOTP?

Re: Two billion email addresses were exposed

#238

Post by windsurfer »

ekjhgkejhgk wrote: post #194
MattSteelblade wrote: post #84

Earlier quoted context omitted.

You can check against the API with just the first characters of your hashed password (SHA-1 or NTLM), for example: https://api.pwnedpasswords.com/range/21BD1 or you can download the entire dataset.

How can you download the entire dataset?

You can download the entire dataset using curl (will be 40+ GB)

    curl -s --retry 10 --retry-all-errors --remote-name-all --parallel --parallel-max 150 "https://api.pwnedpasswords.com/range/{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}"

Re: Two billion email addresses were exposed

#239

Post by kevstev »

hombre_fatal wrote: post #176
eyeundersand wrote: post #46

Earlier quoted context omitted.

+1 for Bitwarden. It is literally the best solution out there. Been getting to increase uptake in personal circles with (very) limited success. The wife keeps trying to convince me that the ship has sailed in trying to protect info online. She's probably right.

Now that I'm not only using a Macbook and iPhone, I've been looking for cross-platform solutions. For a week I've been using KeePassXC + Syncthing between four devices. Syncthing is also syncing my Obsidian vaults which has replaced Apple-only Notes.app. Bitwarden is definitely more polished, and Syncthing is definitely (much) more fiddly than using Bitwarden's and Obsidian's ($5/mo) native syncing tools. But I like…

If you have a nas, I highly recommend you set up a VPN back to your network. It's been a bit of a game changer for me. I don't fiddle around with Dropbox or gdrive anymore, it's just on my nas and it just works. I was even mounting /home from it but that was a bit of overkill and still caused some hassles when I was completely offline- like on an airplane. Vpn has other advantages as well like no longer really having to worry about sketchy wifi networks. It felt annoying and like overkill at first, but I'm never going back to relying on any sync apps again.

Re: Two billion email addresses were exposed

#240

Post by stOneskull »

ptrl600 wrote: post #91

Are there any email services which allow basically unlimited aliases with long, random names? I'm using my own domain right now, but that can only uncover who has leaked my data; does not provide additional privacy.

proton unlimited, i think. mail plus doesn't seem to do it, which kinda sucks.
Post reply on HN