Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

281–290 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#281

Post by stevekemp »

Crito wrote: post #111
stevekemp wrote: post #80

Earlier quoted context omitted.

It took 120+ days for my ebay account to get deleted, but thankfully I could delete my paypal in only a few weeks.

The 120+ days thing with ebay is allegedly because they need to make sure any outstanding deals are closed and accounts settled. Of course that is absolute bullshit, it took them 120+ days to close my account and I had not used it for over 4 years at that point. They actually emailed me telling me that they were closing the account due to inactivity. They gave me 3 or 4 months to log on before it would be killed, so…

I think my story pretty much echos yours; I'd stopped using paypal for a couple of years, and stopped using Ebay.

I cancelled and about three months later I was "compromised". At that point I reset the data to random values, deleted my "ebay@example.com" email alias, and just resigned myself to forgetting about it.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#282

Post by rfnslyr »

amouat wrote: post #173
rfnslyr wrote: post #134

Earlier quoted context omitted.

canwegobacktotypinglikethispleaseyou'reruiningthefun

Not to be a spoilsport, but don't most sites allow spaces in passwords anyway?

Most do but some filter for it. Really varies site to site.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#283

Post by chengl »

Many comments suggest to use password managers like lastpass, 1pass, etc. But I think that may not be a good idea: a. What if lastpass/1pass is compromised? b. You have to login to retrieve your password, which is inconvenient.

I think the best solution to this is to make sure your passwords ONLY exist in your head, nowhere else. And to NOT reuse your passwords, you have to create a unique and reasonably strong one for each service.

So how do I remember all these unique and strong passwords? I create an algorithm which takes two parameters as inputs: my username and the domain of the service, it will do some simple manipulation of the inputs and give me a reasonably strong password. Hence, all you need to do is to remember your algorithm and use it to compute your password when you need it. Of course, you want the algorithm simple enough to be done in your head.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#285

Post by baby »

im3w1l wrote: post #239
baby wrote: post #223

Earlier quoted context omitted.

This seems way too difficult to manage. I wish there was a Gmail like application that anyone could set up easily on its server and that would allow for : quick email generation. You need to sign up to something ? Generate a quick mail that redirects automatically to your main inbox and that you can give away when signing up. If you see that spam is arriving on this email, remove it.

baby+hackernews12345@gmail.com Goes to the inbox of user baby

I already know this trick and don't use it because :

* it's easy to get the real email address from it.

* most sign up form don't accept the "+" sign.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#286

Post by darkarmani »

walden42 wrote: post #194
cleaver wrote: post #184

Earlier quoted context omitted.

The key motivation is not security, but if any account starts receiving spam, I will have a good idea where it is coming from. It also lets me shut off mail from any source. Some services will use that as the username, others allow me to pick my own. Using a password manager helps this whole scheme. Now that I do that, I could go to random email addresses and usernames.

The only problem I've found with this method is the spammers that try to guess your email, so they end up sending emails to "admin@domain.com", "webmaster@domain.com", etc. The catch-all forwards them all to me. The only way around this, I think, is to only have uncommon emails, like instead of admin@domain.com, use contactadmin@domain.com. Put a block on the common ones and you're good to go.

It's not that spammers try to guess your email, but that if you accept any email address as valid they'll notice that you are accepting delivery.

Once i figured this out i just created wildcard aliases that end with a static prefix: netflix-blah@example.com, adobe-blah@example.com, etc. This cuts down on 99% of the random spam.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#287

Post by Udo »

Udo wrote: post #126
thinkpad20 wrote: post #124

Earlier quoted context omitted.

itdoesn'tseemanyharderthanthatcrazycomplexschemetheguyabovehad

That's not the point. The idea is to have different passwords for each site and each device. So in this many-words scheme (which will run afoul of a lot of websites' length restrictions on passwords by the way) I'd have to find a good way to encode the site's name or I'd have to tack on at least four specific words to the existing core sentence. That's not something I'll remember with dozens of sites and devices.

Wow, got downvoted for that. I wouldn't have thought this description of how I do passwords is so controversial.

What's so bad about it?

Re: Have I been pwned? Check if your email has been compromised in a data breach

#288

Post by vxNsr »

prawn wrote: post #230
bentcorner wrote: post #188

Earlier quoted context omitted.

Crap, looks like my wife's email was caught up in the Adobe breach. I think she created an account for reading ebooks with Adobe DRM downloaded from our library. Consider this a heads up for married HN'ers, you should check their emails too.

In Australia, both my wife and I got mailed out letters from Adobe regarding our accounts being potentially compromised. Did that happen elsewhere as well?

I got an email but assumed it was a phishing attempt until I read that they were actually doing this.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#289

Post by cleaver »

octo_t wrote: post #276
walden42 wrote: post #194

Earlier quoted context omitted.

The only problem I've found with this method is the spammers that try to guess your email, so they end up sending emails to "admin@domain.com", "webmaster@domain.com", etc. The catch-all forwards them all to me. The only way around this, I think, is to only have uncommon emails, like instead of admin@domain.com, use contactadmin@domain.com. Put a block on the common ones and you're good to go.

regrettably this is against RFC 2142[1], which states that you need to leave certain mailboxes open (such as abuse@domain, webmaster@domain etc) [1] - http://www.ietf.org/rfc/rfc2142.txt

Quite ironic, isn't it, how "abuse@example.com" is a conduit for abuse?

Spammers effectively killed that RFC.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#290

Post by troyhunt »

danso wrote: post #227
troyhunt wrote: post #198

Earlier quoted context omitted.

This might answer your question: haveibeenpwned.com/HowFastIsAzureTableStorage/?email=foo@foo.com I'm writing up how the back end is done and will post it in the next day or two, IMHO it's massively impressive but also very easy :)

Looking forward to it! The raising of awareness about security is alone pretty awe-inspiring, so the fact that I'm equally piqued by such technical details as the site's backend is really saying something about the impressiveness of the execution

Try this: http://www.troyhunt.com/2013/12/working-with-154-million-rec...
Post reply on HN