Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

141–150 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#141

Post by millerm »

ParkerK wrote: post #137
millerm wrote: post #99

Earlier quoted context omitted.

That's actually a very unadvisable scheme. By doing this you make yourself a target. If any one of those are compromised, attackers will attempt to try that against a lot of popular sites (including banks). If you have your own domain (which I assume you do based on your scheme), I suggest not doing this. You would be better off coming up with a random account name for each and using a password manager to keep track…

>By doing this you make yourself a target. If any one of those are compromised, attackers will attempt to try that against a lot of popular sites (including banks). And if you use the same email for everything (as is the alternative), attackers can attempt to try that against popular sites. So I don't see the downside of this method?

The real key is to not use the same email address across accounts. If you have your own domain, then it's easy.

I actually don't like the idea of using email addresses as user IDs. I believe that was a lazy approach in the first place and this causes too many problems. I'm sure it all started that way because someone wanted your contact info, and since the only way to guarantee a valid email was to make you verify it. It has nothing to do with security.

Nobody said security was easy or convenient.

Anyway, to each his own. I have my own domains and do, unfortunately, have about 100 email addresses/aliases. Yeah, it can be inconvenient to maintain. I originally started using the aliases because I wanted to know who was giving out my email to spammers. I caught a few and stopped doing business with them.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#142

Post by jason_slack »

benjamincburns wrote: post #139
jason_slack wrote: post #105

Earlier quoted context omitted.

You've got me thinking about how I store passwords. I have in the past done: ~ $ echo -n "mypassword" | base64 bXlwYXNzd29yZA== How would one combine the above with md5? on OS X is it `md5 -s ` So basically base64 'mypassword', then md5 the base64 result.

Oh god, I hope you're joking. http://www.codinghorror.com/blog/2007/09/youre-probably-stor...

Well, I wasn't joking, but I didn't realize md5 was as vulnerable as Atwood says it is. SHA-2 or Bcrypt.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#144

Post by mcv »

pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

One of my addresses was also in the Adobe breach. No idea what password I used there, but I'm fairly sure it must have been either my common "junk" password, shared with tons of forums, but nothing that poses any serious risk to me (just to those forums). Or if they had stricter requirements, some variation on it that I always forget, so I have to ask them for a new password every time anyway.

I certainly don't reuse financial or email passwords. Or actually I do, but only for financial and email stuff. But I probably shouldn't reuse them at all.

But those forums? I'm just not going to keep track of a new password for every site I visit.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#145

Post by beering »

awj wrote: post #37
chc wrote: post #28

Earlier quoted context omitted.

You can't steal somebody's email just by knowing their address.

If you wanted to collect likely-valid email addresses to sell to spammers, this would be a good way to go about it. I doubt they are , but can understand the suspicion.

They already have 150M+ valid email addresses from the breach if they wanted to spam people.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#146

Post by thesimpsons1022 »

rfnslyr wrote: post #130
Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

Believe me when I say all your personal information is on SOMEONES computer. Everyones is.

can you tell me more about what you mean? for instance if your wife sends you a nude picture through something like oovoo does that guarantee someone has stolen it?

Re: Have I been pwned? Check if your email has been compromised in a data breach

#147

Post by rickyc091 »

basch wrote: post #117
Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

whynotjustusereallylongpasswordsthatarehardformachinestocrack?

What I've found is that some sites will either truncate your password without telling you or restrict you to 8-20 chars.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#148

Post by cstejerean »

ChuckMcM wrote: post #120
da_n wrote: post #73

Earlier quoted context omitted.

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

Well until the recent 4.x / 3.x screwup [1] that 1Password did it has been quite useful (and like you, my 16 character password at Adobe, even if guessed, would not be useful anywhere else) [1] My 3.x was upgraded to 4.x on my Macbook (unbidden) and the only way to restore compatability with my 3.x on iOS is to pony up another $20. Can't go back to 3.x on the Macbook, not particularly happy about the upgrade fee on i…

FWIW, I think version 4 is a worthwhile upgrade on iOS, and I see the price at $9.99 at the moment (at least in the US store).

Re: Have I been pwned? Check if your email has been compromised in a data breach

#150

Post by rfnslyr »

thesimpsons1022 wrote: post #146
rfnslyr wrote: post #130

Earlier quoted context omitted.

Believe me when I say all your personal information is on SOMEONES computer. Everyones is.

can you tell me more about what you mean? for instance if your wife sends you a nude picture through something like oovoo does that guarantee someone has stolen it?

If you're connected to the world wide web and you send/receive data, there's a strong chance that either:

a) Either sending/receiving machine is broken into

b) Someone or something is intercepting your message

c) The service you are using is broken into

There's just too many holes to plug and too many people with expertise in these domains orders of magnitude above ours that they can use to either be malicious, or help our cause.

Your computer/device needs to be secure. Your other parties devices need to be secure. Your connection needs to be secure. Your third parties service needs to be secure. The internet the third party uses needs to be secure. Their data centre needs to be secure. Then their ISP needs to be secure.

All data is online.

Post reply on HN