Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

311–320 of 470 posts

Re: Two billion email addresses were exposed

#311

Post by froddd »

pessimizer wrote: post #181
jimmar wrote: post #50

I respect Troy Hunt's work. I searched for my email address on https://haveibeenpwned.com/ , and my email was in the latest breach data set. But the site does not give me any way to take action. haveibeenpwned knows what passwords were breached, the people who breached the data knows what passwords were breached, but there does not seem to be any way for _me_, the person affected, to know what password were breached.…

> But the site does not give me any way to take action. It gives you as much information as you should be given. Any more information would just be spreading around the hacked dataset. It does give you an awful lot of information about the specific hacks that exposed your information, and what was the content of that exposure. You may have been owned, but the way you were owned doesn't really matter e.g. I don't care…

Change the password for what account though? The dashboard doesn’t seem to list the actual website(s ) linked to the email/password breached, so how am I to know which password to rotate?

If I follow the recommended best practice, I have a different password for every website or service. That could be hundreds of them. Am I supposed to rotate all of them every time there’s a breach?

Re: Two billion email addresses were exposed

#312

Post by joshka »

worldfoodgood wrote: post #5

The downside to having many vanity urls and giving out a unique email address to each website you visit is that you cannot use haveibeenpwned without paying (despite being a single human). I have no idea how many email addresses I've given out over the years, probably hundreds across at least 6 or 7 domains, and they want to charge me a monthly fee to see which of those have been pwned. I understand they gotta make a…

Troy's response [1] on this use case from a couple of years ago was that you should buy a monthly fee and then cancel it.

[1]: https://www.troyhunt.com/welcome-to-the-new-have-i-been-pwne...

Re: Two billion email addresses were exposed

#313

Post by saintamh »

fencepost wrote: post #291

I was mildly annoyed by the handling of this for domains. I have a personal domain, and now I know that one of the generally service-specific email addresses I've used (most likely with a unique password unless it's Palm levels of old) has been breached with its password. I don't know which one because I don't have a high enough (paid) account. If I'd realized that jumping through the hoops to get onto the site was j…

Domain search is free. I never paid for HIBP and they give me a list of every address @my-domain that’s been leaked.

Edit: others are pointing out that it’s only free for domains with fewer than 10 pwned addresses. I have 8.

Re: Two billion email addresses were exposed

#314

Post by pil0u »

ekropotin wrote: post #260
8cvor6j844qw_d6 wrote: post #214

Earlier quoted context omitted.

I used per-account email with alias services and password managers. Also started migrating old accounts in free time. Now its pretty easy to tell the source of leak by email addresses as well as sources of spam. --- Per-account alias might sound much, but using sieve filtering [1] is amazing, and you can get a comprehensive filtering solution going with 'envelope to' (the actual address receiving the email) + 'header…

I just use + @gmail.com At the end of day day it’s all delivered to myname@gmail.com mailbox, but I can use filters based on part after “+”.

With Gmail, also note that firstname.lastname@gmail.com is equivalent to firstnamelastname@gmail.com or fi.rs.tn.am.el.as.tn.am.e@gmail.com

As some other comment suggested, these rules are easy to tackle by motivated spammers.

Re: Two billion email addresses were exposed

#315

Post by Cthulhu_ »

kccqzy wrote: post #36
naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

Addresses? Most of the time addresses are a matter of public record. I have used https://www.fastpeoplesearch.com/ a couple of times to search for people's addresses and it really works. One day a close friend excitedly told me she bought a new house and I told her the address before she told me about it. Telephone number? There used to be phone books. And I still instinctively think they should be public.

An address can be dangerous if it's e.g. a social network site or blog, anywhere where you post under an alias. People make enemies, have stalkers, or say things online that certain regimes don't like. Granted, this is only really a thing for a minority, but if a minority isn't safe, nobody is.

Re: Two billion email addresses were exposed

#316

Post by sussmannbaka »

willvarfar wrote: post #283
ekropotin wrote: post #260

Earlier quoted context omitted.

I just use + @gmail.com At the end of day day it’s all delivered to myname@gmail.com mailbox, but I can use filters based on part after “+”.

I'd be really surprised if Gmail's + behaviour isn't so well known by spammers that they just strip them off?

even better: those will be spam guaranteed and can just be filtered by rule then

Re: Two billion email addresses were exposed

#318

Post by ekjhgkejhgk »

windsurfer wrote: post #252
ekjhgkejhgk wrote: post #243

Earlier quoted context omitted.

It's not that I couldn't have written that oneliner, it's that I assumed you'd get blocked very quickly.

It is officially recommended by the Troy Hunt: https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader/i...

That's crazy, thank you.

Re: Two billion email addresses were exposed

#319

Post by gblargg »

tapland wrote: post #272
ekropotin wrote: post #260

Earlier quoted context omitted.

I just use + @gmail.com At the end of day day it’s all delivered to myname@gmail.com mailbox, but I can use filters based on part after “+”.

Anyone who’s looked at breach data knows to try yourname+service for any service. This does help in filtering spam though

That's why you have to salt the + portion (look up an old email from the service if you forgot the alias).

Re: Two billion email addresses were exposed

#320

Post by ratherbefuddled »

Marsymars wrote: post #227
Koffiepoeder wrote: post #189

Earlier quoted context omitted.

The moment you put TOTP in Bitwarden it is no longer a 'second factor'. Pretty bad security advice to be honest. Better to use hardware tokens or a secure phone (with enclave) instead (never SMS though).

In most cases a true second factor isn't really what any involved party cares about. My bank (I mean, they use SMS, but pretend they use TOTP) just care about not having to spend money on support because I used "password1!" as my password for every account and lose all my money. I just want to log in to my bank. If I've got a long, random, unique, securely-stored password, I don't actually care about having a second…

> If I've got a long, random, unique, securely-stored password, I don't actually care about having a second factor

I'm not comfortable with my entire online identity being protected by a single line of defence which is a company that I'm paying a few dollars a month to. Not having to type 6 digits off a phone is a pretty minor convenience for me.

Post reply on HN