Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

81–90 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#81

Post by maxerickson »

3rd3 wrote: post #47

Is it possible to apply the same hash function to a string as it’s done in the users database of the Adobe breach? I think it is 3DES. I’ve been able to obtain my (hashed) credentials, but as it seems my account is deactivated at adobe.com (probably due to inactivity?), so I’m not able to test which password I used. :(

The key is not publicly known. Some passwords have been recovered, as discussed here:

http://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-pass...

It would be irresponsible for anybody to share the key, it would reveal all the passwords.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#85

Post by Aldo_MX »

cleaver wrote: post #42

I tend to create a new email address for everything I sign up for. This makes a little harder to check :) EG: twitter@example.com, facebook@example.com, hackernews@example.com It also makes it a little harder for people to find me on social media. Not sure if that's a bug or a feature ;)

catchall FTW

I follow the following pattern with websites:

If the website is important (ex. government), I use @. My filtering rules are extremely strict, and every mail that doesn't come from the expected website gets automatically flagged as spam and deleted. If their DB leaks, I just change the 4 numbers.

If I know the website and it's not an startup, I use @, ex. facebook@example.com. My filtering rules only flag the messages as "maybe spam" when the sender is not in my contacts. If their DB leaks, I change the filter from "maybe spam" to "spam".

If it's a website I don't know, or a startup, I use @, ex. mystartup.io@example.com. I don't filter them, but if I start getting spam, I just simply set the email as an alias to my wormhole (an account I never check that flags anything it receives as spam).

If it's a spam blog, or a website that forces me to create an account by no apparent reason, I just use the wormhole address.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#86

Post by sliverstorm »

k4st wrote: post #63

As someone who was 'pwned' by the Adobe leak, I have no idea how bad the pwnage was. That is, I don't recall what my Adobe password was, and so I have no idea which of my many passwords was compromised. Also, I partially went through the Adobe password reset procedure two or three times--each time guessing at what my original password was. Unfortunately, they accepted all of my guesses, so I was still none the wiser…

Same boat. Don't remember if it's an email/password combo I still use.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#87

Post by rallison »

denzil_correa wrote: post #44
znowi wrote: post #7

Is this a clever way to harvest email addresses? :)

No Passwords: I’m not storing them. Nada. Zip. I just don’t need them and frankly, I don’t want the responsibility either. This is all about raising awareness of the breadth of breaches. http://www.troyhunt.com/2013/12/introducing-have-i-been-pwne...

Considering that this is made my Troy Hunt, I would trust it. He has built up enough reputation in my mind.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#88

Post by elwell »

da_n wrote: post #73
pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

What do you do when you are using a different computer and need to login to site?
Post reply on HN