No matter what anyone says, I am not going to type my password into a site called “Pwned Passwords” lol
A decade of Have I Been Pwned
131–140 of 181 posts
Re: A decade of Have I Been Pwned
#132Earlier quoted context omitted.
Unfortunately I have no source to give. The FBI employee was just giving an example of illegal behavior he knew of. He didn't cite jurisdiction or the names of people involved. Hell - even if he did, I likely wouldn't have remembered it as this was roughly 8 years ago I was in the audience for this (I know I said roughly a decade ago in my prior post - but I checked a receipt for the event and it was in 2015).
Quite likely Randal Schwartz. "In July 1995, Schwartz was prosecuted in the case of State of Oregon vs. Randal Schwartz, which dealt with compromised computer security during his time as a system administrator for Intel. In the process of performing penetration testing, he cracked a number of passwords on Intel's systems. Schwartz was originally convicted on three felony counts, with one reduced to a misdemeanor, but…
Wikipedia is a little light on the details. How much time did he end up serving, and were there any repercussions for the other parties involved?
Re: A decade of Have I Been Pwned
#133Earlier quoted context omitted.
Encountered the same. My hope is that there's a pricing scheme for people like us; may be worth reaching out.
I’m in the same boat — not a company, just an individual doing the separate-email-per-site thing. (UPDATE): I’ve posted a suggestion to the UserVoice community, which it appears Troy actively monitors. If the several (dozens?) of us with this use case upvote it, it may catch his attention. https://haveibeenpwned.uservoice.com/forums/275398-general/s...
Troy responded: https://haveibeenpwned.uservoice.com/forums/275398-general/s...
Basically he suggested doing a monthly subscription for just one month periodically as a way to reduce the cost.
Another option is to read the notification email, and if it’s for Acme Corp, to remember that the associated email must be acme.com@mydomain.com, and then manually check that.
Re: A decade of Have I Been Pwned
#134I have memories of this site providing me with an excellent experience. Now it's just a cash-grab, asking for $169.50/year just to see 100 breached accounts! I use unique email addresses (breach canaries) on every website to detect when sites leak my data. When I tried to search for my domain results with a previous domain ownership verification, I got hit with this error: "In order to search a domain with any more t…
You’re doing a weird thing (running your own email domain), doing an even weirder thing (using a different address per site), and then doing an even more weirder thing (scanning your personal domain for breaches) and your supposition is that very specific use case is a cash cow for Troy Hunt? Come on.
doing an even weirder thing (using a different address per site)
It should actually be considered best practice.
Re: A decade of Have I Been Pwned
#135I have memories of this site providing me with an excellent experience. Now it's just a cash-grab, asking for $169.50/year just to see 100 breached accounts! I use unique email addresses (breach canaries) on every website to detect when sites leak my data. When I tried to search for my domain results with a previous domain ownership verification, I got hit with this error: "In order to search a domain with any more t…
another example of "everything as a service". Bullshit freemium model where a service starts out good, and then once they start getting usage: put the functionality behind paywall and degrade the free service to the point of being useless. Facebook, as bad as it is, has not succumbed to this: 'free Facebook' is still as functional as it was in 2010, but more tracking obviously.
but more tracking obviously
That's a price of its own.
Re: A decade of Have I Been Pwned
#136Earlier quoted context omitted.
You’re doing a weird thing (running your own email domain), doing an even weirder thing (using a different address per site), and then doing an even more weirder thing (scanning your personal domain for breaches) and your supposition is that very specific use case is a cash cow for Troy Hunt? Come on.
doing an even weirder thing (using a different address per site) It should actually be considered best practice.
It is not.
Re: A decade of Have I Been Pwned
#137Earlier quoted context omitted.
Oh, I see the issue. The HIBP database is SHA-1 hashed with no salt. It was created from unhashed passwords. You can't download the unhashed version (you could of course compute it, if you really wanted to; but there's no need). So, the procedure you need to implement is, on login/registration/pw reset, you SHA-1 hash the user's unhashed password and do a indexed lookup on your copy of HIBP's database. Or if you don'…
Ah! Thanks a lot, it now makes sense. So at some point HIBP has the unhashed passwords, they obviously don’t make those public, good trick. How do you handle this from a UX perspective? Just tell the user that password is “not strong enough”?
Password managers that have HIBP integration are open about it - one says "this password appears in a list of compromised passwords"
Re: A decade of Have I Been Pwned
#138Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from crede…
Besides 2FA, rate limiting your login endpoint (both by IP address and username) is a much more robust protection against this attack. Especially if you include temporary bans (e.g. “20 failed login attempts with the same IP, and/or same username, in the past minute = 15 minute ban for that IP and/or username”). A lot of API gateways, K8s ingresses, etc. make this dead simple, and if not it’s also super easy to add with a few lines of code and something like Redis to store counts of recent login attempts.
I do think checking against the HIBP DB is a good call too, but it doesn’t stop this attack overly well, rate limiting is a much better way to stop it.
Re: A decade of Have I Been Pwned
#139Re: A decade of Have I Been Pwned
#140In the past decade, I wonder how many stalker victims have discovered HaveIBeenPwned as the easy directing tool that their abuser used to discover and invade their accounts and privacy.. Yes, yes, I know, the site maintains that it's the victim's responsibility, prior to any bad actor taking advantage of the service, to sign up and then disable their information from showing up in the search. Because the shock and aw…
Can you elaborate how could HIBP be used to abuse? It just checks your email is in a leak.
It points anyone who has an email address to specific leaks that have that email address. These leaks contain additional data beyond the email address, like passwords, location data, message contents, etc.
This enables bad actors to quickly and easily figure out which leaks they need to go look at to find further data related to the email address they searched on.
It'd be a great service if it hadn't spent the last decade deliberately ignoring a fundamental principle of security: Assume there will be bad actors.
It takes a bit of cognitive dissonance to leave the problem unaddressed for so long. eg, if you assume there are no bad actors, there's no need for the service to exist. And if you assume bad actors DO exist, the service needs to protect its core functionality better against being an engine for abuse.