Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

111–120 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#111

Post by Crito »

stevekemp wrote: post #80
zoul wrote: post #19

It’s a bummer to find my e-mail between the leaked Adobe accounts. Especially after the ordeal I had to go through to have my Adobe account “deleted” months ago: You have requested that we deactivate your Adobe account. We have sent a request to the relevant team to process your request. Please note that you will lose access to Adobe services and support for which you have registered or paid for. You will not be able…

It took 120+ days for my ebay account to get deleted, but thankfully I could delete my paypal in only a few weeks.

The 120+ days thing with ebay is allegedly because they need to make sure any outstanding deals are closed and accounts settled.

Of course that is absolute bullshit, it took them 120+ days to close my account and I had not used it for over 4 years at that point. They actually emailed me telling me that they were closing the account due to inactivity. They gave me 3 or 4 months to log on before it would be killed, so I thought to myself "good, saves me the hassle of doing it myself". Fast forward 3-4 months and I get an email telling me my account was compromised. Weird... so I log on, confirm any payment info I had was long since expired, confirmed nothing had happened and that my password was intact... then I scrambled the security question and password just to be safe and told Ebay to delete the account. Cue "this will take 120+ days" bullshit... but whatever.

At nearly the end of that 120+ days I get emailed again telling me the account was compromised. I'm convinced this is a scam they run to trick you into logging into your account, thus resetting the the countdown.

Ebay and paypal are among my least trusted companies. I have a higher opinion of even Comcast or Halliburton.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#112

Post by ivanhoe »

millerm wrote: post #99
cleaver wrote: post #42

I tend to create a new email address for everything I sign up for. This makes a little harder to check :) EG: twitter@example.com, facebook@example.com, hackernews@example.com It also makes it a little harder for people to find me on social media. Not sure if that's a bug or a feature ;)

That's actually a very unadvisable scheme. By doing this you make yourself a target. If any one of those are compromised, attackers will attempt to try that against a lot of popular sites (including banks). If you have your own domain (which I assume you do based on your scheme), I suggest not doing this. You would be better off coming up with a random account name for each and using a password manager to keep track…

the downside is that using random accounts on your domain requires a catch-all email rules on your server (unless you add each address by hand, but frankly that's too much of a hassle)

Re: Have I been pwned? Check if your email has been compromised in a data breach

#113

Post by andy_ppp »

Idea: Write a service that you pass the unsalted hash to (only salted hashes in the DB please), and the email address and hash type. Stop people if their hash matches any previous ones.

Obviously this would stop people providing the same password for all services... But might creep some people out!

Would hopefully highlight how insecure/guessable non salted hashes are. Does anyone know best practice for doing things like this?

Re: Have I been pwned? Check if your email has been compromised in a data breach

#114

Post by gmisra »

da_n wrote: post #73
pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

I am surprised by how few people are aware of this: https://www.pwdhash.com/

Convenience provided via Chrome/Firefox extensions, portability provided by the website.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#115

Post by sejje »

TrainedMonkey wrote: post #104
pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

I got pwned by adobe too. Luckily password there was one of my "weak" ones, and I do not use it anywhere of importance.

That's not very "lucky," it seems very intentional.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#116

Post by elwell »

baddox wrote: post #96
zenojevski wrote: post #95

Earlier quoted context omitted.

Presumably you can open your password manager's web service and do it from there.

That or use your phone. Most password managers have apps.

Ok, that makes the most sense to me.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#117

Post by basch »

Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

whynotjustusereallylongpasswordsthatarehardformachinestocrack?

Re: Have I been pwned? Check if your email has been compromised in a data breach

#118

Post by nhaehnle »

elwell wrote: post #88
da_n wrote: post #73

Earlier quoted context omitted.

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

What do you do when you are using a different computer and need to login to site?

Use a browser add-on for exporting/importing passwords, transfer the exports on an encrypted USB stick.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#119

Post by icebraining »

danso wrote: post #38
ericlewis wrote: post #31

Earlier quoted context omitted.

Whoa, slow your roll buddy. This could be really easily done by preprocessing the data and creating simple objects in redis. One object = email, sub objects of email could just be flags for the service it's on.

It's not the processing that's the bottleneck, it's the gathering and the initiative to do that gathering which is rare. For example, criminal records and notices have always been collectable and, once collectable, searchable. But the incidence of "a prospective employer googled me and found a 5 year old article of me publicly urinating in college" became more of an issue in the age of Google. This isn't an indictmen…

Mitigation would be fairly simple: instead of a web form, put up an email address that you can send a message to and get back the result.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#120

Post by ChuckMcM »

da_n wrote: post #73
pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

Well until the recent 4.x / 3.x screwup [1] that 1Password did it has been quite useful (and like you, my 16 character password at Adobe, even if guessed, would not be useful anywhere else)

[1] My 3.x was upgraded to 4.x on my Macbook (unbidden) and the only way to restore compatability with my 3.x on iOS is to pony up another $20. Can't go back to 3.x on the Macbook, not particularly happy about the upgrade fee on iOS.

Post reply on HN