Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

321–330 of 470 posts

Re: Two billion email addresses were exposed

#321

Post by mkl »

ycuser2 wrote: post #297
mkl wrote: post #158

Earlier quoted context omitted.

Use a catch-all inbox. Fastmail supports them well in its web interface. I use unique addresses for every organisation.

The problem with catch-all inbox is when you have to reply to an email. Then you have to create the email address to be able to send emails from it. Or are there other solutions?

When you reply, any sensible system will use the address you received it at. Fastmail does this, as do many others (I used Thunderbird for many years, possibly with an extension to do that). To send an email from scratch you just type the address you want in the from field or select from a list. At no point is there any need to create specific addresses, as the catch-all means all addresses are already valid.

Re: Two billion email addresses were exposed

#322

Post by frm88 »

LilBytes wrote: post #235
8cvor6j844qw_d6 wrote: post #225

Anyone have thoughts on Bitwarden / 1Password / Proton Pass? Proton Pass feels too new for me but eagerly awaiting good feedbacks / reviews. However, "don't put all your eggs in one basket" might apply here. Went with Bitwarden instead of 1Password since its open source, and I imagine (in my uninformed opinion) that a larger userbase by being free means more issues might be encountered and ironed out.

1Password is awesome. I haven't really looked at anything else but I found >2 years ago the UI of BitWarden to be ordinary. And it was more awkward to manage a company. Went with 1Password in the end, and that you get a free Family account with a Business account is great. Your position on how BitWarden is open source should contribute to any decision you make though.

I switched from Windows to Linux a couple of weeks ago and to KeePass XC. I like it that I can easily copy/paste passwords on sites where autofill is not allowed, e.g. banking. It's free, open source, no tracking and local and you can donate directly to the org. Of late I grow somewhat allergic to commercial solutions.

Re: Two billion email addresses were exposed

#323

Post by fragmede »

selcuka wrote: post #288
tapland wrote: post #272

Earlier quoted context omitted.

Anyone who’s looked at breach data knows to try yourname+service for any service. This does help in filtering spam though

It doesn't have to be literally the service name. Can be any unique alphanumeric suffix you make up randomly. As long as you use a password manager you don't have to remember it.

Indeed, it needs to be more than just the company name if you want it to be useful later. If the email address used is company@example.com, any idiot could guess company. But receiving email to company_wkhx46@example.com is clearly gotta be from them, or they got hacked.

Re: Two billion email addresses were exposed

#324

Post by scoot »

8cvor6j844qw_d6 wrote: post #214
naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

I used per-account email with alias services and password managers. Also started migrating old accounts in free time. Now its pretty easy to tell the source of leak by email addresses as well as sources of spam. --- Per-account alias might sound much, but using sieve filtering [1] is amazing, and you can get a comprehensive filtering solution going with 'envelope to' (the actual address receiving the email) + 'header…

> I used per-account email [addresses] with alias services

I do too (anything@mysubdomain.example.com), but but online services collude with data brokers to share so much information [0] that I don't doubt that many of these "separate" profiles have been aggregated.

Unfortunately the services that supposedly offer to have your personal data removed from data brokers don't seem to support aliasing, so no straightforward way to either find out or have the data removed.

[0] Just look at the scary list of third-party cookies you can't opt out of on Coursera [1], for example:

Match and combine data from other data sources 419 partners can use this feature Always Active

Identify devices based on information transmitted automatically 546 partners can use this feature Always Active

Link different devices 358 partners can use this feature Always Active

Deliver and present advertising and content 582 partners can use this special purpose Always Active

[1] https://www.coursera.org/about/cookies-manage

Re: Two billion email addresses were exposed

#325

Post by zazaulola »

jiggawatts wrote: post #153
anonu wrote: post #142

> we run on Azure SQL Hyperscale, which we maxed out at 80 cores for almost two weeks the data challenge is interesting here. there's clearly a lot of data - but really its just emails and passwords you need to keep track of. SQL feels like overkill that will be too slow and cost you too much. are there better solutions? 15 billion records of email+password, assume ~40bytes thats roughly 600GB should be searchable wi…

> we run on Azure SQL Hyperscale Definitely the wrong technology, and was almost certainly picked only because Troy Hunt is a "Microsoft Regional Director and MVP". Many other technologies scale better for this kind of workload. Heck, you could ask ChatGPT to write a short C# CLI tool to process the data on one machine, you don't even need a huge box. This kind of thing comes up here regularly on HN for problems such…

Try Blake3 instead SHA-1

https://github.com/BLAKE3-team/BLAKE3

Re: Two billion email addresses were exposed

#326

Post by ErroneousBosh »

windsurfer wrote: post #252
ekjhgkejhgk wrote: post #243

Earlier quoted context omitted.

It's not that I couldn't have written that oneliner, it's that I assumed you'd get blocked very quickly.

It is officially recommended by the Troy Hunt: https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader/i...

That speaks to a certain confidence in one's servers ability to hold up under load, doesn't it?

"Oh you want your own copy? Sure, just thrash seven shades of shit out of the database. Here's how."

Re: Two billion email addresses were exposed

#327

Post by marliechiller »

fainpul wrote: post #295
lelandfe wrote: post #245

Earlier quoted context omitted.

(the keyboard smash username is apropos) > Per-account alias might sound much Not only does this not sound too much, this is a feature Apple offers called Hide My Email: https://support.apple.com/en-us/102548

And one day you've had it with Apple's latest user-hostile shenanigans and switch to Linux. What now? Do you just keep paying for iCloud+ forever?

wouldnt this be the case for any vendor you choose?

Re: Two billion email addresses were exposed

#328

Post by ErroneousBosh »

naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

It's probably more important to keep passwords safe, but lots of people treat their email address like some kind of "sensitive secret". "Oh but I don't want to get spam" - my dude you are going to get spam.

There's a guy who lives near me who, when he parks his car, very carefully puts tape over the number plate "because otherwise people might see my registration number". Because apparently if people can see your car's registration number they can somehow just steal your car and the police won't do anything because the number plate was visible. Mad, absolutely barking mad.

Re: Two billion email addresses were exposed

#329

Post by johnisgood »

teekert wrote: post #108
eyeundersand wrote: post #46

Earlier quoted context omitted.

+1 for Bitwarden. It is literally the best solution out there. Been getting to increase uptake in personal circles with (very) limited success. The wife keeps trying to convince me that the ship has sailed in trying to protect info online. She's probably right.

I switched from Bitwarden to Proton pass (because we got Proton family) and I find to be equally good. Ineven find sharing credentials a bit easier as it does not require organizations, you can just share with individuals. Proton also has a separate 2fa totp app.

Why do we need a separate 2FA TOTP app for anything? :| I have a feeling too many people have no idea what TOTP is, and how easy it is to implement.

Re: Two billion email addresses were exposed

#330

Post by jiggawatts »

zazaulola wrote: post #325
jiggawatts wrote: post #153

Earlier quoted context omitted.

> we run on Azure SQL Hyperscale Definitely the wrong technology, and was almost certainly picked only because Troy Hunt is a "Microsoft Regional Director and MVP". Many other technologies scale better for this kind of workload. Heck, you could ask ChatGPT to write a short C# CLI tool to process the data on one machine, you don't even need a huge box. This kind of thing comes up here regularly on HN for problems such…

Try Blake3 instead SHA-1 https://github.com/BLAKE3-team/BLAKE3

The sorting is the slowest step by far.

Hashing is so fast that you can hand-wave it away as zero cost relative to the time taken to read such a large amount of data. Also, you only have to do it once for the whole input, which means that it's O(n) time where 'n' is the gigabytes of passwords you have.

Sorting is going to need about O(n * log n) time even if it's entirely in memory, but more if it has to spool to disk storage then it'll take much longer than the hashing step.

PS: I just realised that 2 billion passwords is not actually that much data -- only 40 GB of hashes -- that's well within the range of what's "easy" to sort in-memory by simply creating an array of hashes that size and calling a standard library sort function.

Post reply on HN