Pwned on amazon too. Thankfully it was a demo account, with an old email and password.
Have I been pwned? Check if your email has been compromised in a data breach
191–200 of 294 posts
Re: Have I been pwned? Check if your email has been compromised in a data breach
#192For those who aren't aware https://chrome.google.com/webstore/detail/one-last-pass-pass...
Re: Have I been pwned? Check if your email has been compromised in a data breach
#193For those freaking out about somebody "misusing" this information (your e-mail address) .... I have some bad news. E-mail addresses are not secret. They cross the wire in plaintext, they get stored in various mail server logs in various relays across the globe, they get passed around by spam analysis services, anti-virus services, and any company you submit it to has the right to sell it and any other information abo…
I'd prefer not to use this site since, if I'm affected, it signals to whoever owns the site that I'm a live person whose accounts might be worth probing.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#194Earlier quoted context omitted.
That's actually a very unadvisable scheme. By doing this you make yourself a target. If any one of those are compromised, attackers will attempt to try that against a lot of popular sites (including banks). If you have your own domain (which I assume you do based on your scheme), I suggest not doing this. You would be better off coming up with a random account name for each and using a password manager to keep track…
The key motivation is not security, but if any account starts receiving spam, I will have a good idea where it is coming from. It also lets me shut off mail from any source. Some services will use that as the username, others allow me to pick my own. Using a password manager helps this whole scheme. Now that I do that, I could go to random email addresses and usernames.
The only problem I've found with this method is the spammers that try to guess your email, so they end up sending emails to "admin@domain.com", "webmaster@domain.com", etc. The catch-all forwards them all to me.
The only way around this, I think, is to only have uncommon emails, like instead of admin@domain.com, use contactadmin@domain.com. Put a block on the common ones and you're good to go.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#195Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…
Yahoo here. How the hell did the hackers get the passwords in plain text? Were they seriously unencrypted?
Re: Have I been pwned? Check if your email has been compromised in a data breach
#196Who's to say these guys aren't stealing our emails?
They don't need to steal if you publish your email address yourself wfunction... http://comments.gmane.org/gmane.comp.lang.d.general/86923
I don't appreciate you stalking me and posting that here (just because it's accessible somewhere on the internet doesn't mean I want to make it more public), but as a matter of fact I wasn't talking about that email address in the first place.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#197For those freaking out about somebody "misusing" this information (your e-mail address) .... I have some bad news. E-mail addresses are not secret. They cross the wire in plaintext, they get stored in various mail server logs in various relays across the globe, they get passed around by spam analysis services, anti-virus services, and any company you submit it to has the right to sell it and any other information abo…
OTOH, California was the first of many US states to require disclosure or
notification of personal information security breaches,
https://en.wikipedia.org/wiki/Security_breach_notification_l...
and will soon be requiring disclosure of breaches of "personal information that would permit access to an online or email account"
https://www.huntonprivacyblog.com/2013/09/articles/californi...
Re: Have I been pwned? Check if your email has been compromised in a data breach
#198I have a question...how big is the backend to this site? Its average response is about 100ms, which, to me, seems impressively fast considering the number of bulk records and the amount of concurrent traffic that such a site is getting. Besides the obvious indexing of the email field...anything special behind the curtains? Lots of machines? Something else besides a simple key lookup? Or am I just vastly overestimatin…
This might answer your question: haveibeenpwned.com/HowFastIsAzureTableStorage/?email=foo@foo.com
I'm writing up how the back end is done and will post it in the next day or two, IMHO it's massively impressive but also very easy :)
Re: Have I been pwned? Check if your email has been compromised in a data breach
#199Earlier quoted context omitted.
Thanks for that; I had ignored the Adobe leak, because why would I have created an Adobe account? Turns out I did at some point, so I guess I'm the goat there.
Often you need to create an account or somehow register your email at sites, just to get something very basic, like a free download, or use a feedback form. This demonstrates nicely why that's a bad idea.
http://www.bugmenot.com/ is useful for such a case, registration required for a download.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#200Feature request: allow wildcard searches, with a sufficiently large literal starting prefix, to return a simple "zero" or "more-than-one" result.
EG: "john*@gmail.com"
I'd then feel better about typing my address into a random site, and be able to check site-specific variants of my address more easily.