Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

121–130 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#121

Post by brandynwhite »

icebraining wrote: post #102
Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

I do something similar, but I then hash the result and use that as the password. That way, if someone gets hold of a couple of passwords, it's harder to derive the "core'.

For those who aren't aware https://www.pwdhash.com/

Re: Have I been pwned? Check if your email has been compromised in a data breach

#122

Post by Udo »

basch wrote: post #117
Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

whynotjustusereallylongpasswordsthatarehardformachinestocrack?

becausetheyoftenfailwithwebsitesandit'skindofdifficultvaryingthemobscurelybutmeaningfullyenoughonapersitebasis.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#124

Post by thinkpad20 »

Udo wrote: post #122
basch wrote: post #117

Earlier quoted context omitted.

whynotjustusereallylongpasswordsthatarehardformachinestocrack?

becausetheyoftenfailwithwebsitesandit'skindofdifficultvaryingthemobscurelybutmeaningfullyenoughonapersitebasis.

itdoesn'tseemanyharderthanthatcrazycomplexschemetheguyabovehad

Re: Have I been pwned? Check if your email has been compromised in a data breach

#125

Post by TrainedMonkey »

sejje wrote: post #115
TrainedMonkey wrote: post #104

Earlier quoted context omitted.

I got pwned by adobe too. Luckily password there was one of my "weak" ones, and I do not use it anywhere of importance.

That's not very "lucky," it seems very intentional.

It was lucky in a sense that if adobe required complex passwords more important password would have been leaked. It was also lucky in a sense that adobe itself got hacked instead of entity that has one of my more sophisticated and thus valuable passwords.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#126

Post by Udo »

thinkpad20 wrote: post #124
Udo wrote: post #122

Earlier quoted context omitted.

becausetheyoftenfailwithwebsitesandit'skindofdifficultvaryingthemobscurelybutmeaningfullyenoughonapersitebasis.

itdoesn'tseemanyharderthanthatcrazycomplexschemetheguyabovehad

That's not the point. The idea is to have different passwords for each site and each device. So in this many-words scheme (which will run afoul of a lot of websites' length restrictions on passwords by the way) I'd have to find a good way to encode the site's name or I'd have to tack on at least four specific words to the existing core sentence. That's not something I'll remember with dozens of sites and devices.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#127

Post by icebraining »

brandynwhite wrote: post #121
icebraining wrote: post #102

Earlier quoted context omitted.

I do something similar, but I then hash the result and use that as the password. That way, if someone gets hold of a couple of passwords, it's harder to derive the "core'.

For those who aren't aware https://www.pwdhash.com/

Yeah, though I don't use it, since I only found out about it after I had been using my own system for a while.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#128

Post by [deleted] »

basch wrote: post #117
Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

whynotjustusereallylongpasswordsthatarehardformachinestocrack?

[deleted]

Re: Have I been pwned? Check if your email has been compromised in a data breach

#129

Post by rfnslyr »

mintplant wrote: post #68
rfnslyr wrote: post #57

Earlier quoted context omitted.

Same here, with completely randomized passwords 60 chars long and different emails. IM INVISIBLE!

Might not want to give away your exact password length publicly.

Don't worry, it was yet another trick.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#130

Post by rfnslyr »

Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

Believe me when I say all your personal information is on SOMEONES computer. Everyones is.
Post reply on HN