Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

131–140 of 470 posts

Re: Two billion email addresses were exposed

#131

Post by sloped »

digiconfucius wrote: post #109
sloped wrote: post #107

I switched to using masked emails with Fastmail primarily so I could see who sold my data. The potential security benefit was not really a driver. Having 1Password be able to generate a unique email makes it a no-brainer these days. For those services that require a username that is not your email, they can usually be used without the domain part. Works really well. I even wrote a tiny little local only web app that…

Any interesting finds on companies that tried to sell your data?

Not really any places where things get sold, but opt-in in the background for newsletters is bad in certain sectors. Ticket platforms are terrible. I like to use a new email for every event and boy does that lead to new round of clicking opt-out until I can deactivate the email after the event has concluded.

Re: Two billion email addresses were exposed

#133

Post by Razengan »

naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

So by this point, if anyone does anything naughty online they could just pin it on an hacker using their identity, no?

Re: Two billion email addresses were exposed

#136

Post by chinathrow »

username44 wrote: post #49
kccqzy wrote: post #33

Earlier quoted context omitted.

The domain search feature on haveibeenpwned is/was free. I registered my domain on haveibeenpwned back in 2017 and I got two emails about breaches, one in 2020 and another in 2022. I did not pay.

I wasn’t aware of this feature, but can confirm. Just tried and it is free. Log into dashboard, under business there is a domains tab. Enter your domain there and verify ownership. Didn’t ask for payment.

But I can't find the old list of what address was affected where. I only see my own address.

Re: Two billion email addresses were exposed

#137

Post by kmeisthax »

sfilmeyer wrote: post #85
cryptoegorophy wrote: post #81

-Setup a website with article that 3 billion emails were exposed -Offer a form to check if your email was leaked -start getting confirmed emails list

Troy Hunt has been running Have I Been Pwned for years. He even uses the k-anonymity model to allow you to search if a password has been pwned without giving him the password if you don't trust him. I get your general point, but he's been a leader in this space and walking the walk for a decade. I'm not even into security stuff or anything particularly related to this, and I still recognized his name in the OP domain…

More importantly, since HIBP sells monitoring services to 1Password, if they were maliciously collecting this data they would be immediately sued to oblivion.

Re: Two billion email addresses were exposed

#138

Post by esnard »

zahlman wrote: post #126
MattSteelblade wrote: post #84

Earlier quoted context omitted.

You can check against the API with just the first characters of your hashed password (SHA-1 or NTLM), for example: https://api.pwnedpasswords.com/range/21BD1 or you can download the entire dataset.

Second line I already notice: > 000F6468C6E4D09C0C239A4C2769501B3DD:5894 ... Does the 5894 mean what I think it does?

5894 means that the password appeared 5894 times in the dataset.

5894 is not the password associated with the hash.

Re: Two billion email addresses were exposed

#139

Post by mrbluecoat »

neogodless wrote: post #123
naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

I use unique email addresses per domain name, and I believe IHaveBeenPwned shows me at 39 unique email addresses breached! (So many that seeing which ones have been breached would now cost me $22 / month... IHaveBeenPwned is starting to feel like an extortion racket of its own..)

I feel you. The aggregate email breach list just feels like a rainbow table at this point.

Re: Two billion email addresses were exposed

#140

Post by zahlman »

bobmcnamara wrote: post #114
ekjhgkejhgk wrote: post #73

Earlier quoted context omitted.

No, it doesn't mean that, that's ridiculous. How would that work? Magic?

Download all the hashes first - not practical.

The above post https://news.ycombinator.com/item?id=45840724 links to 71.3 KiB of data; since it's a 5-nybble prefix (20 bits) we may easily estimate a size of 71.3 GiB assuming that's a representative sample. Not unfeasible nowadays, but it seems you do have to make separate requests and would presumably be rate-limited on them.

If you only download the hash pages corresponding to passwords you hold, even supposing that everything else is fully compromised, an attacker would have to reverse a couple thousand SHA-1 hashes, dodge hash collisions, and brute-force with the results (yes, yes: arson, murder and jaywalking) to pwn you.

Post reply on HN