Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

241–250 of 470 posts

Re: Two billion email addresses were exposed

#241

Post by eightys3v3n »

hombre_fatal wrote: post #176
eyeundersand wrote: post #46

Earlier quoted context omitted.

+1 for Bitwarden. It is literally the best solution out there. Been getting to increase uptake in personal circles with (very) limited success. The wife keeps trying to convince me that the ship has sailed in trying to protect info online. She's probably right.

Now that I'm not only using a Macbook and iPhone, I've been looking for cross-platform solutions. For a week I've been using KeePassXC + Syncthing between four devices. Syncthing is also syncing my Obsidian vaults which has replaced Apple-only Notes.app. Bitwarden is definitely more polished, and Syncthing is definitely (much) more fiddly than using Bitwarden's and Obsidian's ($5/mo) native syncing tools. But I like…

One consideration is that Bitwarden seems to not work fully in an offline state the same way your setup would. I constantly try to edit or add a password while offline and can't. I think this somewhat negates the collision situation though.

Re: Two billion email addresses were exposed

#242

Post by sandeepkd »

naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

To confirm, data/info leaks happened on the server/application side. How does a solution like Bitwarden on the client side helps with this situation?

As per my understanding the only possible threat it saves against is someone trying to brute force for your password against the application. And may be ease the cognitive burden of remembering different passwords.

Re: Two billion email addresses were exposed

#243

Post by ekjhgkejhgk »

windsurfer wrote: post #238
ekjhgkejhgk wrote: post #194

Earlier quoted context omitted.

How can you download the entire dataset?

You can download the entire dataset using curl (will be 40+ GB) curl -s --retry 10 --retry-all-errors --remote-name-all --parallel --parallel-max 150 "https://api.pwnedpasswords.com/range/{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}"

It's not that I couldn't have written that oneliner, it's that I assumed you'd get blocked very quickly.

Re: Two billion email addresses were exposed

#244

Post by s5300 »

dheera wrote: post #192
naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

I generally don't give my real address or real phone number to anyone who doesn't legally need it. I use a virtual address as the billing address on my credit cards and for registering for things that don't need to know where I sleep. The government can have at my real info, but private companies have bad data security.

[dead]

Re: Two billion email addresses were exposed

#245

Post by lelandfe »

8cvor6j844qw_d6 wrote: post #214
naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

I used per-account email with alias services and password managers. Also started migrating old accounts in free time. Now its pretty easy to tell the source of leak by email addresses as well as sources of spam. --- Per-account alias might sound much, but using sieve filtering [1] is amazing, and you can get a comprehensive filtering solution going with 'envelope to' (the actual address receiving the email) + 'header…

(the keyboard smash username is apropos)

> Per-account alias might sound much

Not only does this not sound too much, this is a feature Apple offers called Hide My Email: https://support.apple.com/en-us/102548

Re: Two billion email addresses were exposed

#246

Post by red369 »

ekjhgkejhgk wrote: post #60
junon wrote: post #53

Earlier quoted context omitted.

https://haveibeenpwned.com/Passwords

[flagged]

I was going to provide my passwords to any random person on the internet, Troy Hunt might be close to the top of the list, but I think your sentiment is sensible.

I remember searching the dataset being fairly straight forward. It's been a while since I've done it, but I think I just downloaded the text file and then grepped it for hashes of my passwords, but I see people doing much more useful things:

https://medium.com/analytics-vidhya/creating-a-local-version...

Re: Two billion email addresses were exposed

#247

Post by NetMageSCW »

jimmar wrote: post #50

I respect Troy Hunt's work. I searched for my email address on https://haveibeenpwned.com/ , and my email was in the latest breach data set. But the site does not give me any way to take action. haveibeenpwned knows what passwords were breached, the people who breached the data knows what passwords were breached, but there does not seem to be any way for _me_, the person affected, to know what password were breached.…

If you read the instructions, you will discover https://haveibeenpwned.com/Passwords which will let you enter a password and securely check if it has been published in a breach.

If it has, it is either a simple password that multiple people are using, or a complex secure password that can make you pretty confident it is your password that has been published.

1Password just does the same thing for all of your passwords - it doesn’t check against your account name either. That information isn’t stored so they can’t become a new source of breached accounts (as explained at the site).

Re: Two billion email addresses were exposed

#248

Post by red369 »

zahlman wrote: post #126
MattSteelblade wrote: post #84

Earlier quoted context omitted.

You can check against the API with just the first characters of your hashed password (SHA-1 or NTLM), for example: https://api.pwnedpasswords.com/range/21BD1 or you can download the entire dataset.

Second line I already notice: > 000F6468C6E4D09C0C239A4C2769501B3DD:5894 ... Does the 5894 mean what I think it does?

I remember when I was searching the file for some passwords my friends and family use, it took me a while to work out that number too. There are some passwords that many people seem to independently come up with and think must be reasonably secure. I suppose they are to the most basic of attacks.

Re: Two billion email addresses were exposed

#249

Post by adabyron »

senorqa wrote: post #218

If there's no meaningful reward or punishment for keeping or leaking PII, companies won't do anything about it. They'll keep collecting sensitive inf unless they're educated or forced not to collect unnecessary PII.

Not just this but the lack of diligence by companies that allow accounts to be created, bills to go unpaid & then sent to collection agencies is something that needs to change.

Speaking as someone who has had companies give away my PII and then other companies open accounts with it without contacting me until bills are due.

None of this should be the fault of innocent individuals.

Re: Two billion email addresses were exposed

#250

Post by theonething »

eyeundersand wrote: post #46
naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

+1 for Bitwarden. It is literally the best solution out there. Been getting to increase uptake in personal circles with (very) limited success. The wife keeps trying to convince me that the ship has sailed in trying to protect info online. She's probably right.

Can anyone with experience with 1Password and Bitwarden share their opinions on each.

I've been on 1Password for years and am wondering if I'm missing anything.

Post reply on HN