Two billion email addresses were exposed • Hacker News Board

Re: Two billion email addresses were exposed

#371

Post by Thorrez » Fri, Nov 07, 2025, 1:45 PM UTC

froddd wrote: post #309

jimmar wrote: post #50

I respect Troy Hunt's work. I searched for my email address on https://haveibeenpwned.com/ , and my email was in the latest breach data set. But the site does not give me any way to take action. haveibeenpwned knows what passwords were breached, the people who breached the data knows what passwords were breached, but there does not seem to be any way for _me_, the person affected, to know what password were breached.…

The details about the “Stealer Logs” on the dashboard even state: > The websites the stealer logs were captured against are searchable via the HIBP dashboard. There is no way to use the HIBP dashboard to figure out what domains my email address appears against. Am I meant to change all passwords associated with that email address? Or do I need to get a paid subscription to query the API to figure out exactly what pas…

You don't need a paid subscription. The API is free.

https://haveibeenpwned.com/API/v3

Re: Two billion email addresses were exposed

#372

Post by Thorrez » Fri, Nov 07, 2025, 1:45 PM UTC

subscribed wrote: post #356

froddd wrote: post #309

Earlier quoted context omitted.

The details about the “Stealer Logs” on the dashboard even state: > The websites the stealer logs were captured against are searchable via the HIBP dashboard. There is no way to use the HIBP dashboard to figure out what domains my email address appears against. Am I meant to change all passwords associated with that email address? Or do I need to get a paid subscription to query the API to figure out exactly what pas…

It's quite certainly a up selling attempt. I once spend a couple of hours to see what was actually exposed in the infostealer breach my email appeared (eg: payment data? Physical address? Government id ?) to no avail. This service is toxic tbh.

The API is free.

https://haveibeenpwned.com/API/v3

Re: Two billion email addresses were exposed

#373

Post by Thorrez » Fri, Nov 07, 2025, 1:46 PM UTC

the8472 wrote: post #346

junon wrote: post #53

Earlier quoted context omitted.

https://haveibeenpwned.com/Passwords

This doesn't help. If the email address check says the address has been exposed it doesn't tell you which password that was used together with that has been exposed. Was it one from 10 years ago you don't even remember? Or that's still actively in use? Which one of my hundreds of passwords?

You can use the API to check all of your passwords. Then you'll know the security state of all of your passwords.

https://haveibeenpwned.com/API/v3

Re: Two billion email addresses were exposed

#374

Post by rjmunro » Fri, Nov 07, 2025, 1:49 PM UTC

ErroneousBosh wrote: post #326

windsurfer wrote: post #252

Earlier quoted context omitted.

It is officially recommended by the Troy Hunt: https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader/i...

That speaks to a certain confidence in one's servers ability to hold up under load, doesn't it? "Oh you want your own copy? Sure, just thrash seven shades of shit out of the database. Here's how."

It's not a database, it's just files. And they are hosted by Cloudflare so they can cope with a lot of downloads.

I think he should make the files smaller my removing the second half of the hashes, i.e. reduce it from 40 hex digits to 20. This increases the change of a false positive (i.e. I enter my password, it says it was compromised but it wasn't, it just has the same hash as one that did) from 1 in 10^48 to 1 in 10^24 (per password), but that's still a huge number. (There's less than 10^10 people in the world, they only have a few passwords each). This will approximately halve the download, maybe more because the first half of each hash is more compressible (when sorted) the second half is totally random.

Re: Two billion email addresses were exposed

#375

Post by Thorrez » Fri, Nov 07, 2025, 1:49 PM UTC

ekjhgkejhgk wrote: post #60

junon wrote: post #53

Earlier quoted context omitted.

https://haveibeenpwned.com/Passwords

[flagged]

You can download all the hashes and check against them locally. https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader

Re: Two billion email addresses were exposed

#376

Post by froddd » Fri, Nov 07, 2025, 1:51 PM UTC

Thorrez wrote: post #371

froddd wrote: post #309

Earlier quoted context omitted.

The details about the “Stealer Logs” on the dashboard even state: > The websites the stealer logs were captured against are searchable via the HIBP dashboard. There is no way to use the HIBP dashboard to figure out what domains my email address appears against. Am I meant to change all passwords associated with that email address? Or do I need to get a paid subscription to query the API to figure out exactly what pas…

You don't need a paid subscription. The API is free. https://haveibeenpwned.com/API/v3

The API is not free.

https://haveibeenpwned.com/API/v3#Authorisation

Re: Two billion email addresses were exposed

#377

Post by sotix » Fri, Nov 07, 2025, 1:53 PM UTC

ekropotin wrote: post #260

8cvor6j844qw_d6 wrote: post #214

Earlier quoted context omitted.

I used per-account email with alias services and password managers. Also started migrating old accounts in free time. Now its pretty easy to tell the source of leak by email addresses as well as sources of spam. --- Per-account alias might sound much, but using sieve filtering [1] is amazing, and you can get a comprehensive filtering solution going with 'envelope to' (the actual address receiving the email) + 'header…

I just use + @gmail.com At the end of day day it’s all delivered to myname@gmail.com mailbox, but I can use filters based on part after “+”.

Careful with this method. I was unable to purchase plane tickets from Southwest or even change my email address because they changed their parsing rules on me and silently dropped the plus. I found out most airlines don't have a ticket counter to buy a ticket the old fashioned way! But the premier help can issue tickets. Took me two months to have CS get someone to run a DML to remove my "bad" email address.

Re: Two billion email addresses were exposed

#378

Post by elric » Fri, Nov 07, 2025, 2:05 PM UTC

bobmcnamara wrote: post #253

layer8 wrote: post #120

Earlier quoted context omitted.

The number of passwords is probably smaller. ;)

~1.3e9 passwords, ~1.9e9 (account, password) tuples, if I understood

The joke, presumably, was that many people share the same shitty password (e.g. 123456, password1, etc).

Re: Two billion email addresses were exposed

#379

Post by docmars » Fri, Nov 07, 2025, 2:05 PM UTC

askl wrote: post #345

pil0u wrote: post #314

Earlier quoted context omitted.

With Gmail, also note that firstname.lastname@gmail.com is equivalent to firstnamelastname@gmail.com or fi.rs.tn.am.el.as.tn.am.e@gmail.com As some other comment suggested, these rules are easy to tackle by motivated spammers.

If they were motivated, they wouldn't work as spammers.

I see what ya did there, you get an upvote.

Re: Two billion email addresses were exposed

#380

Post by jerf » Fri, Nov 07, 2025, 2:07 PM UTC

Havoc wrote: post #124

jerf wrote: post #56

On the plus side, Troy can save a lot of DB space now. Instead of storing which emails have been compromised at this point he can replace that with just def email_compromised(email): return True

Not necessarily. Both my main addresses still come back clean after years in use. The one I use for random crap has 9 hits though.

If we're going to take my obviously unserious suggestion seriously, I'd suggest a bigger problem is that his stack isn't in Python and the code for whether an email is pwned probably isn't remotely structured as a function call like that...

but other than that I'm sure it's a good idea.