Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

131–140 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#131

Post by finnw »

k4st wrote: post #63

As someone who was 'pwned' by the Adobe leak, I have no idea how bad the pwnage was. That is, I don't recall what my Adobe password was, and so I have no idea which of my many passwords was compromised. Also, I partially went through the Adobe password reset procedure two or three times--each time guessing at what my original password was. Unfortunately, they accepted all of my guesses, so I was still none the wiser…

> I don't recall what my Adobe password was

This will tell you your password hint (and if any other user had an identical password, you will see their hint also. ) https://lastpass.com/adobe/

Re: Have I been pwned? Check if your email has been compromised in a data breach

#132

Post by rfnslyr »

elwell wrote: post #88
da_n wrote: post #73

Earlier quoted context omitted.

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

What do you do when you are using a different computer and need to login to site?

I carry a little piece of paper in my wallet that has my private key further encrypted by myself, and that encrypted key is used to decrypt other passwords through a private web/mobile app I made. The top encryption key I have is just some sort of simple algebraic mumbo jumbo formula I used to scramble my private key just a bit, and I change it up once in awhile, and have that written down. What's in my memory is how I jumbled it.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#133

Post by beering »

peterwwillis wrote: post #70

For those freaking out about somebody "misusing" this information (your e-mail address) .... I have some bad news. E-mail addresses are not secret. They cross the wire in plaintext, they get stored in various mail server logs in various relays across the globe, they get passed around by spam analysis services, anti-virus services, and any company you submit it to has the right to sell it and any other information abo…

Hi, two things.

People knowing that you have account yyy@example.com at example.net could use that information in a spear-fishing attack, or know that you're involved in a controversial website, prohibited website, etc.

Emails were not the only things that were stolen. For example, in the Adobe breach, encrypted passwords were stolen. If your email address is shown as being in the Adobe breach, that also means that your encrypted password, password hint, etc. were stolen. For Sony, maybe credit card information.

If this website was only about whether email addresses were leaked, then why would anyone type in their email address into this website (thus leaking your email)?

Re: Have I been pwned? Check if your email has been compromised in a data breach

#134

Post by rfnslyr »

Udo wrote: post #126
thinkpad20 wrote: post #124

Earlier quoted context omitted.

itdoesn'tseemanyharderthanthatcrazycomplexschemetheguyabovehad

That's not the point. The idea is to have different passwords for each site and each device. So in this many-words scheme (which will run afoul of a lot of websites' length restrictions on passwords by the way) I'd have to find a good way to encode the site's name or I'd have to tack on at least four specific words to the existing core sentence. That's not something I'll remember with dozens of sites and devices.

canwegobacktotypinglikethispleaseyou'reruiningthefun

Re: Have I been pwned? Check if your email has been compromised in a data breach

#135

Post by finnw »

sejje wrote: post #115
TrainedMonkey wrote: post #104

Earlier quoted context omitted.

I got pwned by adobe too. Luckily password there was one of my "weak" ones, and I do not use it anywhere of importance.

That's not very "lucky," it seems very intentional.

I had a very insecure password on adobe.com. i.e. low-enough entropy that 55 users had the exact same password. I figured since Adobe do not have my credit card number and there is nothing to gain by impersonating me on that site, it did not matter. I have not used the same email/password combination elsewhere, but even if I did it would only be on other low-value accounts. I'm not worried about attackers finding it by association either (they will have it already from dictionary attacks.)

Re: Have I been pwned? Check if your email has been compromised in a data breach

#136

Post by Udo »

rfnslyr wrote: post #130
Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

Believe me when I say all your personal information is on SOMEONES computer. Everyones is.

I know. If I wanted my information to be "safe", I wouldn't have an online profile at all. For starters, I wouldn't use Google services. It's a matter of limiting exposure at this point. I know the NSA reads my email and can probably log into my home router, but I don't want everybody else to do the same. Otherwise, let's all change our passwords to "password" and be done with it. Just because protection isn't close to 100% doesn't mean I don't want any at all.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#137

Post by ParkerK »

millerm wrote: post #99
cleaver wrote: post #42

I tend to create a new email address for everything I sign up for. This makes a little harder to check :) EG: twitter@example.com, facebook@example.com, hackernews@example.com It also makes it a little harder for people to find me on social media. Not sure if that's a bug or a feature ;)

That's actually a very unadvisable scheme. By doing this you make yourself a target. If any one of those are compromised, attackers will attempt to try that against a lot of popular sites (including banks). If you have your own domain (which I assume you do based on your scheme), I suggest not doing this. You would be better off coming up with a random account name for each and using a password manager to keep track…

>By doing this you make yourself a target. If any one of those are compromised, attackers will attempt to try that against a lot of popular sites (including banks).

And if you use the same email for everything (as is the alternative), attackers can attempt to try that against popular sites. So I don't see the downside of this method?

Re: Have I been pwned? Check if your email has been compromised in a data breach

#139

Post by benjamincburns »

jason_slack wrote: post #105
jrockway wrote: post #91

Earlier quoted context omitted.

It's possible to write a tool that will figure out all algorithms/salts used by compromised sites, and then hash your password with those algorithms/salts and see if that hash appears in the compromised password files. Most of the compromised sites use worthless password storage mechanisms, like unsalted hashes or plaintext, so this level of sophistication is mostly unnecessary. For example, say you used the password…

You've got me thinking about how I store passwords. I have in the past done: ~ $ echo -n "mypassword" | base64 bXlwYXNzd29yZA== How would one combine the above with md5? on OS X is it `md5 -s ` So basically base64 'mypassword', then md5 the base64 result.

Oh god, I hope you're joking.

http://www.codinghorror.com/blog/2007/09/youre-probably-stor...

Re: Have I been pwned? Check if your email has been compromised in a data breach

#140

Post by Zoomla »

rfnslyr wrote: post #57
cleaver wrote: post #42

I tend to create a new email address for everything I sign up for. This makes a little harder to check :) EG: twitter@example.com, facebook@example.com, hackernews@example.com It also makes it a little harder for people to find me on social media. Not sure if that's a bug or a feature ;)

Same here, with completely randomized passwords 60 chars long and different emails. IM INVISIBLE!

60 chars passwords probably reach the char limit imposed by many different services.
Post reply on HN