Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

101–110 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#101

Post by BlackDeath3 »

ufmace wrote: post #71
wil421 wrote: post #17

Adobe got me. Does lastpass work great for checking banking on cellphones and other logins that would require a cut and paste on a desktop?

Yup, works great, I've been using it for over a year. To login to banking on your phone, you first go to the Lastpass app, login to that, then copy the password to your bank, open their app, and paste the password in. Lastpass for Android also now has a notification that stays up while you're logged in, to remind yourself to log back out when you're done.

That's the way that it worked when I first started using it, but am I the only person using the full Lastpass browser these days? It's far more convenient than the old Authenticator -> Lastpass -> Browser authentication workflow that I had to use before the upgrade.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#102

Post by icebraining »

Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

I do something similar, but I then hash the result and use that as the password. That way, if someone gets hold of a couple of passwords, it's harder to derive the "core'.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#103

Post by BlackDeath3 »

elwell wrote: post #88
da_n wrote: post #73

Earlier quoted context omitted.

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

What do you do when you are using a different computer and need to login to site?

If you don't mind paying a small annual fee, Lastpass is a very nice tool for automated password management across devices.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#104

Post by TrainedMonkey »

pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

I got pwned by adobe too. Luckily password there was one of my "weak" ones, and I do not use it anywhere of importance.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#105

Post by jason_slack »

jrockway wrote: post #91
benjamincburns wrote: post #79

I'd like to see a site which validates whether or not your password is exposed. Users should assume that it is exposed, but it would be nice to know wether or not it's floating around in some list somewhere. Problem is, I can't think of a computationally efficient way to perform this check securely. I could see handing the user an nonce, asking them to manually hash their password concatenated with the nonce, and the…

It's possible to write a tool that will figure out all algorithms/salts used by compromised sites, and then hash your password with those algorithms/salts and see if that hash appears in the compromised password files. Most of the compromised sites use worthless password storage mechanisms, like unsalted hashes or plaintext, so this level of sophistication is mostly unnecessary. For example, say you used the password…

You've got me thinking about how I store passwords. I have in the past done:

    ~ $ echo -n "mypassword" | base64
    bXlwYXNzd29yZA==
How would one combine the above with md5? on OS X is it `md5 -s `

So basically base64 'mypassword', then md5 the base64 result.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#106

Post by Udo »

icebraining wrote: post #102
Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

I do something similar, but I then hash the result and use that as the password. That way, if someone gets hold of a couple of passwords, it's harder to derive the "core'.

That's a good procedure, a few weeks ago I'd have deemed you paranoid but obviously there is no practical limit to paranoia anymore ;)

However, the hashing step makes it impractical for me on different devices in certain situations. I don't want to rely on browser extensions or apps either. So I'm changing my passwords to the output of an algorithm I can do in my head now.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#107

Post by TillE »

k4st wrote: post #63

As someone who was 'pwned' by the Adobe leak, I have no idea how bad the pwnage was. That is, I don't recall what my Adobe password was, and so I have no idea which of my many passwords was compromised. Also, I partially went through the Adobe password reset procedure two or three times--each time guessing at what my original password was. Unfortunately, they accepted all of my guesses, so I was still none the wiser…

Yeah, I'm downloading the leak and trying to check if I can deduce whether it was the common I-don't-care password I think it was. A couple other people had used the same password, but the hints didn't help me.

http://security.stackexchange.com/questions/45413/how-do-i-d...

Re: Have I been pwned? Check if your email has been compromised in a data breach

#108

Post by graeme »

pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

Anyone know what adobe's password requirements were? I don't know which password I used there: Adobe forced me to change it without letting me test the old one.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#109

Post by w-m »

That Adobe got hacked isn't your fault - that you chose a weak password and reused it, is.

Showing a few more numbers might help more people realize that their passwords aren't actually unique, creative or safe. The data that came out of the Adobe hack is pretty interesting, and the results are much more tangible than "oh no, pwned!".

Something like:

"Your password was used by 8290 people.

Furthermore, 2615 persons gave a plain text hint as to what the password might be."

Re: Have I been pwned? Check if your email has been compromised in a data breach

#110

Post by mdxn »

This database includes emails that were simply listed in these data breaches. Newer Adobe account emails were put in as entries in the database, but their associated password/hint data was not. There were quite a large number of these in the leaked db, including some of mine. I had to download the whole thing and search to realize that the only information revealed/stored was the email address.
Post reply on HN