Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

401–410 of 470 posts

Re: Two billion email addresses were exposed

#401

Post by mapt »

jwr wrote: post #344
8cvor6j844qw_d6 wrote: post #214

Earlier quoted context omitted.

I used per-account email with alias services and password managers. Also started migrating old accounts in free time. Now its pretty easy to tell the source of leak by email addresses as well as sources of spam. --- Per-account alias might sound much, but using sieve filtering [1] is amazing, and you can get a comprehensive filtering solution going with 'envelope to' (the actual address receiving the email) + 'header…

> I used per-account email with alias services and password managers. For people who want to do this, be sure to get it right. I run a SaaS with a free tier, and I see people register with "fancy+nospam+servicename@gmail.com" addresses. Many of those become undeliverable or are left unread forever because of filtering rules. So when my system sends a warning E-mail that the account will be deleted due to inactivity,…

It was infuriating to me when normal_email+site_name@gmail.com stopped working for registration on some sites.

Fucked up my Costco registration, a variety of other things.

This sort of quasi-pseudonymity is required for basic security/privacy in 2025; It's the only way to get a handle on who's allowed to send you email, since we've never bothered to fix spoofing or impose a cost on spam. I've been trying to use it since Sneakemail was a free service back in the pre-Gmail days.

Re: Two billion email addresses were exposed

#402

Post by mapt »

sotix wrote: post #377
ekropotin wrote: post #260

Earlier quoted context omitted.

I just use + @gmail.com At the end of day day it’s all delivered to myname@gmail.com mailbox, but I can use filters based on part after “+”.

Careful with this method. I was unable to purchase plane tickets from Southwest or even change my email address because they changed their parsing rules on me and silently dropped the plus. I found out most airlines don't have a ticket counter to buy a ticket the old fashioned way! But the premier help can issue tickets. Took me two months to have CS get someone to run a DML to remove my "bad" email address.

It's probably easier to tell them "I lost access to that email, I need to set up a new account". People do this all the time.

On some level, my employer uses emails as the primary key for customer accounts, the baseline identifier which all information is filed under. It's quite ridiculous.

Re: Two billion email addresses were exposed

#403

Post by ekjhgkejhgk »

rjmunro wrote: post #374
ErroneousBosh wrote: post #326

Earlier quoted context omitted.

That speaks to a certain confidence in one's servers ability to hold up under load, doesn't it? "Oh you want your own copy? Sure, just thrash seven shades of shit out of the database. Here's how."

It's not a database, it's just files. And they are hosted by Cloudflare so they can cope with a lot of downloads. I think he should make the files smaller my removing the second half of the hashes, i.e. reduce it from 40 hex digits to 20. This increases the change of a false positive (i.e. I enter my password, it says it was compromised but it wasn't, it just has the same hash as one that did) from 1 in 10^48 to 1 in…

> It's not a database, it's just files. And they are hosted by Cloudflare so they can cope with a lot of downloads.

Database: a usually large collection of data organized especially for rapid search and retrieval (as by a computer) [1]

It is a database. Stop nitpicking.

[1] https://www.merriam-webster.com/dictionary/database

Re: Two billion email addresses were exposed

#404

Post by kevin_thibedeau »

willvarfar wrote: post #283
ekropotin wrote: post #260

Earlier quoted context omitted.

I just use + @gmail.com At the end of day day it’s all delivered to myname@gmail.com mailbox, but I can use filters based on part after “+”.

I'd be really surprised if Gmail's + behaviour isn't so well known by spammers that they just strip them off?

This is one of the reasons I switched to a different provider using a custom domain. I can make new addresses in any format I want. There's zero risk of a spammer stripping them down to a base address for the primary account. They also don't get rejected by broken validators.

Re: Two billion email addresses were exposed

#405

Post by troyvit »

shinypants wrote: post #119
troyvit wrote: post #98

Earlier quoted context omitted.

I self-host through Vaultwarden but I think I miss this. Besides, I feel like paying these guys anyway just for the great product. We use 1Password at $dayjob and it's so primitive by comparison.

What is lacking in 1Password by comparison? I pay for a family plan but maybe I should switch next year.

Here are the things that get me, and maybe it's because I haven't configured it well yet.

1. On firefox first start-up is slow after unlocking to actually find a password for a site. The interface says, "No logins for xyz.com" for maybe 5 seconds before the login loads.

2. Along those lines when I open it first thing in FF the box for its password isn't focused and I have to click it.

3. The keyboard combo to open it also only works in Chrome.

4. To add a new login I have to go to the site. I haven't figured out how to do it from within the plugin.

5. We get alerts at least once a week about service disruptions but they don't seem to actually affect me.

6. I like Bitwarden's command line tool but I bet 1Password has something at least as good that I haven't found yet.

Re: Two billion email addresses were exposed

#406

Post by troyvit »

nagisa wrote: post #193
troyvit wrote: post #98

Earlier quoted context omitted.

I self-host through Vaultwarden but I think I miss this. Besides, I feel like paying these guys anyway just for the great product. We use 1Password at $dayjob and it's so primitive by comparison.

TOTP works with vaultwarden.

Oh cool! I'll have to dig into it.

Re: Two billion email addresses were exposed

#407

Post by dangerboysteve »

Is it me, or is anyone just numb to all these breach articles? I take all the precautions, use 2FA everywhere, stay away from sketchy sites, use ad/malware blocker and the issue is always never the individual. It's usually the website/app and their lack of security, not keeping up with patching or sloppy programming.

Re: Two billion email addresses were exposed

#408

Post by bookofjoe »

As a complete non-techie reading hundreds of comments on this it strikes me that there are a pretty much unlimited number of solutions/methods employed and described by HN readers — which makes me conclude none of them is THE best answer. It's like we say in medicine: the fact that there are 100 remedies for hiccups means none of them usually work.

Re: Two billion email addresses were exposed

#409

Post by neogodless »

AlienRobot wrote: post #115
junon wrote: post #53

Earlier quoted context omitted.

https://haveibeenpwned.com/Passwords

my password: 2,408 password: 46,628,605 your password: 609 good password: 22 long password: 2 secure password: 317 safe password: 29 bad password: 86 this password sucks: 1 i hate this website: 16 username: 83,569 my username: 4 your username: 1 let me login: 0 admin: 41,072,830 abcdef: 873,564 abcdef1: 147,103 abcdef!: 4,109 abcdef1!: 1,401 123456: 179,863,340 hunter2: 50,474 correct horse battery staple: 384 Correc…

correcthorsebatterystaple (no spaces) 4,163

Re: Two billion email addresses were exposed

#410

Post by prein »

kevin_thibedeau wrote: post #404
willvarfar wrote: post #283

Earlier quoted context omitted.

I'd be really surprised if Gmail's + behaviour isn't so well known by spammers that they just strip them off?

This is one of the reasons I switched to a different provider using a custom domain. I can make new addresses in any format I want. There's zero risk of a spammer stripping them down to a base address for the primary account. They also don't get rejected by broken validators.

yep, i use fastmail with a custom domain. i have a catch all email set up, so i just register any account on sitename.com as "sitename@mydomain" and it all gets sorted into a catch all folder. I can then run rules if i want it to go into a certain category like "bills" or just straight to the garbage.
Post reply on HN