Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

221–230 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#221

Post by tlrobinson »

Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

Is there an easy way to check a password using cracklib via the command line? Preferably on OS X.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#222

Post by Udo »

tlrobinson wrote: post #221
Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

Is there an easy way to check a password using cracklib via the command line? Preferably on OS X.

It doesn't come with OS X, but I suppose there should be a port available somewhere. Otherwise, Virtualbox and some minimal distro are probably your best bet.

On Linux command line, you just feed the password to it:

  echo "password" | cracklib-check

Re: Have I been pwned? Check if your email has been compromised in a data breach

#223

Post by baby »

Aldo_MX wrote: post #85
cleaver wrote: post #42

I tend to create a new email address for everything I sign up for. This makes a little harder to check :) EG: twitter@example.com, facebook@example.com, hackernews@example.com It also makes it a little harder for people to find me on social media. Not sure if that's a bug or a feature ;)

catchall FTW I follow the following pattern with websites: If the website is important (ex. government), I use @ . My filtering rules are extremely strict, and every mail that doesn't come from the expected website gets automatically flagged as spam and deleted. If their DB leaks, I just change the 4 numbers. If I know the website and it's not an startup, I use @ , ex. facebook@example.com. My filtering rules only fl…

This seems way too difficult to manage.

I wish there was a Gmail like application that anyone could set up easily on its server and that would allow for : quick email generation.

You need to sign up to something ? Generate a quick mail that redirects automatically to your main inbox and that you can give away when signing up.

If you see that spam is arriving on this email, remove it.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#224

Post by esurc »

graeme wrote: post #108
pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

Anyone know what adobe's password requirements were? I don't know which password I used there: Adobe forced me to change it without letting me test the old one.

For the Adobe breach specifically, you might try the site set up by Last Pass, which checks your email against the breached data: https://lastpass.com/adobe/

The added feature is that, if your email is in the list, Last Pass will share with you how many others had your same password -- and the list of all password hints associated with that password. If more than a handful of others used the same password, that should jog your memory about which you used.

P.S. I'm not associated with Last Pass and actually use a different product. But I found this site very helpful.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#225

Post by rmk2 »

thrill wrote: post #218
walden42 wrote: post #195

Earlier quoted context omitted.

Yahoo here. How the hell did the hackers get the passwords in plain text? Were they seriously unencrypted?

They were encrypted, but with no variation between the hashes for per email. https://lastpass.com/adobe/ will show you the password hints associated with the (in my case) 200 people with the same (hashed) password. The clues would be sufficient to guess the password. I've gone to generating a unique password with a simple random number generator if the end site supports password recovery (in case Chrome's password me…

This is not meant as criticism: Is there any particular reason for all the tr pipes? Is there any advantage to using tr instead of base64?

I essentially use the following:

  base64

Re: Have I been pwned? Check if your email has been compromised in a data breach

#226

Post by thrill »

rmk2 wrote: post #225
thrill wrote: post #218

Earlier quoted context omitted.

They were encrypted, but with no variation between the hashes for per email. https://lastpass.com/adobe/ will show you the password hints associated with the (in my case) 200 people with the same (hashed) password. The clues would be sufficient to guess the password. I've gone to generating a unique password with a simple random number generator if the end site supports password recovery (in case Chrome's password me…

This is not meant as criticism: Is there any particular reason for all the tr pipes? Is there any advantage to using tr instead of base64 ? I essentially use the following: base64

Criticism welcome. Yours is nicer.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#227

Post by danso »

troyhunt wrote: post #198
danso wrote: post #12

I have a question...how big is the backend to this site? Its average response is about 100ms, which, to me, seems impressively fast considering the number of bulk records and the amount of concurrent traffic that such a site is getting. Besides the obvious indexing of the email field...anything special behind the curtains? Lots of machines? Something else besides a simple key lookup? Or am I just vastly overestimatin…

This might answer your question: haveibeenpwned.com/HowFastIsAzureTableStorage/?email=foo@foo.com I'm writing up how the back end is done and will post it in the next day or two, IMHO it's massively impressive but also very easy :)

Looking forward to it! The raising of awareness about security is alone pretty awe-inspiring, so the fact that I'm equally piqued by such technical details as the site's backend is really saying something about the impressiveness of the execution

Re: Have I been pwned? Check if your email has been compromised in a data breach

#228

Post by Gustomaximus »

I've started to sign up to sites with a unique email address based on the websites URL.

E.g. If I signed up to Myspace I would use Myspace@exampledomain.com

I have the mail server at "www.exampledomain.com" set to accept all emails under the domain so I can see if someone has passed on my details legitimately or via hacking.

Since I've started about 12 months ago I've not found any cross pollination which seems a good sign for the industry in general.

It also adds a layer of security as your sign-up email changes for different websites if you use the same password across several.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#229

Post by jackalope »

thrill wrote: post #226
rmk2 wrote: post #225

Earlier quoted context omitted.

This is not meant as criticism: Is there any particular reason for all the tr pipes? Is there any advantage to using tr instead of base64 ? I essentially use the following: base64

Criticism welcome. Yours is nicer.

I use this for a little more entropy:

    LANG=C tr -dc "[:print:]"

Re: Have I been pwned? Check if your email has been compromised in a data breach

#230

Post by prawn »

bentcorner wrote: post #188
da_n wrote: post #73

Earlier quoted context omitted.

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

Crap, looks like my wife's email was caught up in the Adobe breach. I think she created an account for reading ebooks with Adobe DRM downloaded from our library. Consider this a heads up for married HN'ers, you should check their emails too.

In Australia, both my wife and I got mailed out letters from Adobe regarding our accounts being potentially compromised. Did that happen elsewhere as well?
Post reply on HN