Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

291–300 of 470 posts

Re: Two billion email addresses were exposed

#291

Post by fencepost »

I was mildly annoyed by the handling of this for domains. I have a personal domain, and now I know that one of the generally service-specific email addresses I've used (most likely with a unique password unless it's Palm levels of old) has been breached with its password. I don't know which one because I don't have a high enough (paid) account.

If I'd realized that jumping through the hoops to get onto the site was just going to tell me I'd need a paid account I'd have saved myself a few minutes. As it was it made the whole experience feel like I fell for a sales email.

Re: Two billion email addresses were exposed

#292

Post by Huppie »

bfg_9k wrote: post #276
theonething wrote: post #250

Earlier quoted context omitted.

Can anyone with experience with 1Password and Bitwarden share their opinions on each. I've been on 1Password for years and am wondering if I'm missing anything.

1P is closed source and have had a number of breaches in the past. Bitwarden have had none that I'm aware of, and they're FOSS. I however have been preferring ProtonPass lately (also FOSS) and really like the layout over BW.

> and have had a number of breaches in the past

Do you have a source for this claim of multiple past breaches? The only one I know of is the Okta breach.

For me they're still firmly in the 'one of the best options out there' category because cross-platform usability is incredibly good imho. I will admit it's been quite a while since I migrated from KeyPass so maybe these other options have improved too.

Re: Two billion email addresses were exposed

#293

Post by NetMageSCW »

guelo wrote: post #61
worldfoodgood wrote: post #5

The downside to having many vanity urls and giving out a unique email address to each website you visit is that you cannot use haveibeenpwned without paying (despite being a single human). I have no idea how many email addresses I've given out over the years, probably hundreds across at least 6 or 7 domains, and they want to charge me a monthly fee to see which of those have been pwned. I understand they gotta make a…

I have the more typical one email used with hundreds of passwords on many websites. haveibeenpwned is also useless for me, it will tell me that my email was compromised but not which sites or passwords. I guess I could check each password individually, hope each password is globally unique to me, and then try to match it back to the website where I used it so I can change the password.

If you don’t know which web site uses a particular password, how do you ever login to that website?

Re: Two billion email addresses were exposed

#294

Post by NetMageSCW »

Springtime wrote: post #277

This is a massive PITA for any users who exclusively use unique passwords and various unique addresses, as it sounds like the source of the breach(es) is unknown (so hard to judge which accounts would be affected without using Troy's sites to test everything or find some searchable dump online somewhere dubious).

Just check each unique password and then you know which sites need a password change?

Re: Two billion email addresses were exposed

#295

Post by fainpul »

lelandfe wrote: post #245
8cvor6j844qw_d6 wrote: post #214

Earlier quoted context omitted.

I used per-account email with alias services and password managers. Also started migrating old accounts in free time. Now its pretty easy to tell the source of leak by email addresses as well as sources of spam. --- Per-account alias might sound much, but using sieve filtering [1] is amazing, and you can get a comprehensive filtering solution going with 'envelope to' (the actual address receiving the email) + 'header…

(the keyboard smash username is apropos) > Per-account alias might sound much Not only does this not sound too much, this is a feature Apple offers called Hide My Email: https://support.apple.com/en-us/102548

And one day you've had it with Apple's latest user-hostile shenanigans and switch to Linux. What now? Do you just keep paying for iCloud+ forever?

Re: Two billion email addresses were exposed

#296

Post by sam345 »

troyvit wrote: post #98
stronglikedan wrote: post #78

Earlier quoted context omitted.

> Bitwarden Best when paid for so you can do 2FA with TOTP codes!

I self-host through Vaultwarden but I think I miss this. Besides, I feel like paying these guys anyway just for the great product. We use 1Password at $dayjob and it's so primitive by comparison.

How is 1password primitive? It does totp. It integrates with TPM in Windows hello. It does sh keys and has its own agent which is a huge help. It's sync is nearly instantaneous. It handles multiple accounts with ease.

Re: Two billion email addresses were exposed

#297

Post by ycuser2 »

mkl wrote: post #158
ptrl600 wrote: post #91

Are there any email services which allow basically unlimited aliases with long, random names? I'm using my own domain right now, but that can only uncover who has leaked my data; does not provide additional privacy.

Use a catch-all inbox. Fastmail supports them well in its web interface. I use unique addresses for every organisation.

The problem with catch-all inbox is when you have to reply to an email. Then you have to create the email address to be able to send emails from it. Or are there other solutions?

Re: Two billion email addresses were exposed

#298

Post by NetMageSCW »

gorgoiler wrote: post #82

I’ve always had a bit of a chip on my shoulder about HIBP’s switch to charging for domain searches. It felt a bit like those travel visa scalpers who charge 50 CURRENCY_UNIT to file an otherwise gratis form on your behalf. Law enforcement should provide this kind of service as a public good. They don’t, but if you do instead, I don’t think it’s cool to unilaterally privatize the service and turn it into a commercial…

How much did you donate to keep HIBP running?

What is the URL to your free HIBP alternative?

Re: Two billion email addresses were exposed

#299

Post by ycuser2 »

TZubiri wrote: post #166
worldfoodgood wrote: post #5

The downside to having many vanity urls and giving out a unique email address to each website you visit is that you cannot use haveibeenpwned without paying (despite being a single human). I have no idea how many email addresses I've given out over the years, probably hundreds across at least 6 or 7 domains, and they want to charge me a monthly fee to see which of those have been pwned. I understand they gotta make a…

You need a domain, and possibly a paid mail provider with catch all support. So cost was always part of this strategy

The problem with catch-all inbox is when you have to reply to an email. Then you have to create the email address to be able to send emails from it. Or are there other solutions?

Re: Two billion email addresses were exposed

#300

Post by mesrik »

sneak wrote: post #270
ekropotin wrote: post #260

Earlier quoted context omitted.

I just use + @gmail.com At the end of day day it’s all delivered to myname@gmail.com mailbox, but I can use filters based on part after “+”.

As someone who deals in breach data this is a simple regex to strip out.

>As someone who deals in breach data this is a simple regex to strip out.

Sure it is, but at least you do get later, post leak, a slight chance find out where leak originated.

Data stealers seldom strip out that +extension part before the selling or otherwise dump it somewhere. And while it's passed on, you get to see address as you gave to that party that had leak. Reason seller don't strip of it is perhaps because they sell by number of unique addresses and while +extension usage is quite rare they make more money when they don't strip it off too.

Information where it leaked can be very useful information to pass leaker at least up till point they have announced they know about the compromise happened. I've done that since turn of century too many times I've lost count already and been quite many times the first to get them know that they had a problem there.

And sure I've received thank you emails that I gave them early head-up info about the issue.

Post reply on HN