Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

171–180 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#171

Post by Aldo_MX »

eli wrote: post #158
Aldo_MX wrote: post #85

Earlier quoted context omitted.

catchall FTW I follow the following pattern with websites: If the website is important (ex. government), I use @ . My filtering rules are extremely strict, and every mail that doesn't come from the expected website gets automatically flagged as spam and deleted. If their DB leaks, I just change the 4 numbers. If I know the website and it's not an startup, I use @ , ex. facebook@example.com. My filtering rules only fl…

That seems like a lot of overhead to manage. Also, you're going to have a bad day if a spam bot decides to spam thousands of @yourdomain.com. Maybe that's fallen out of practice, but I've seen it happen before.

Not really, in this year I had changed only 1 filter, the initial setup may be cumbersome, but the end result is worth the effort.

And about the spam to random addresses, in 8 years the most extreme problem I had faced is spam to censored addresses like git...@domain.com (thanks google code).

Re: Have I been pwned? Check if your email has been compromised in a data breach

#172

Post by bigiain »

elwell wrote: post #88
da_n wrote: post #73

Earlier quoted context omitted.

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

What do you do when you are using a different computer and need to login to site?

For some logins, the answer is "Sorry Dave, I can't do that." If I don't have the private cert, or the ssh cert, or the right hole in the firewall - there are many thing I've chosen intentionally to not be able to log in to using someone else's computer.

For lesser security critical logins, I've got my password software (1Password) on my phone (and iPad). For some intermediate level logins, I need my phone or iPad anyway, I've got TOTP two favor auth (using Google's Authenticator app) on a bunch of important stuff (Amazon/AWS, DigitalOcean, Dropbox, Guthub, the email account that all my domain names are registered with and to which password resets go, and a few other things…)

Re: Have I been pwned? Check if your email has been compromised in a data breach

#173

Post by amouat »

rfnslyr wrote: post #134
Udo wrote: post #126

Earlier quoted context omitted.

That's not the point. The idea is to have different passwords for each site and each device. So in this many-words scheme (which will run afoul of a lot of websites' length restrictions on passwords by the way) I'd have to find a good way to encode the site's name or I'd have to tack on at least four specific words to the existing core sentence. That's not something I'll remember with dozens of sites and devices.

canwegobacktotypinglikethispleaseyou'reruiningthefun

Not to be a spoilsport, but don't most sites allow spaces in passwords anyway?

Re: Have I been pwned? Check if your email has been compromised in a data breach

#174

Post by jdmichal »

gmisra wrote: post #114
da_n wrote: post #73

Earlier quoted context omitted.

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

I am surprised by how few people are aware of this: https://www.pwdhash.com/ Convenience provided via Chrome/Firefox extensions, portability provided by the website.

There is also http://supergenpass.com, which uses a JavaScript bookmarklet to do the hashing.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#176

Post by cynwoody »

TrainedMonkey wrote: post #104
pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

I got pwned by adobe too. Luckily password there was one of my "weak" ones, and I do not use it anywhere of importance.

Same here. I used my throw-away email to sign up at Adobe, along with my weak throw-away password. I don't have any Adobe licenses or such. The only Adobe product I use is the Flash plugin.

The email account is on Hotmail and currently has about 54k messages in its in-box, 99.9% unread. I use it to create accounts on news sites and annoying fora and such, always with the same weak password. About the only time I log into is to respond to password confirmation requests generated during account creations.

Originally, the weak password was also my email password. However, a few years ago, the email account got hacked severely, such that MSFT wouldn't let me in until I reset the password. It now has a strong password.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#177

Post by lancewiggs »

cstejerean wrote: post #148
ChuckMcM wrote: post #120

Earlier quoted context omitted.

Well until the recent 4.x / 3.x screwup [1] that 1Password did it has been quite useful (and like you, my 16 character password at Adobe, even if guessed, would not be useful anywhere else) [1] My 3.x was upgraded to 4.x on my Macbook (unbidden) and the only way to restore compatability with my 3.x on iOS is to pony up another $20. Can't go back to 3.x on the Macbook, not particularly happy about the upgrade fee on i…

FWIW, I think version 4 is a worthwhile upgrade on iOS, and I see the price at $9.99 at the moment (at least in the US store).

It was quite an astonishing move to break 1Password (mine is still broken) when Apple released their own free product.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#178

Post by esalazar »

basch wrote: post #117
Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

whynotjustusereallylongpasswordsthatarehardformachinestocrack?

You can also use an algorithm. I do something like create a 'base' that is used for all sites. And then something like take the number of letters in the url google = 6 and add it the beginning. Then take the second letter from the right and last, 'o' and 'e' and add it to the end. In the end you get 6baseoe. Unique password for each website.
Post reply on HN