Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A decade of Have I Been Pwned

troyhunt.com

Post reply on HN
Print view View original

161–170 of 181 posts

Re: A decade of Have I Been Pwned

#161

Post by aaronharnly »

Vicinity9635 wrote: post #67

Anybody been in more than 20 data breeches? All my stuff's been locked down with a password manager/2fa so I'm not worried, but having been on the internet for ages it's pretty funny at this point.

I use a separate email address with every site, so I can be confident that each the below is a wholly independent breach. I've had email addresses (and sometimes other data including name, password or password hash, etc) breached from:

    Adobe.com
    Bit.ly
    Bytargentina.com
    Cafepress.com
    Chegg.com
    Contentful.com (via Apollo)
    Dailymotion.com
    Disqus.com
    Dropbox.com
    Edmodo.com
    Facebook.com (via Zynga)
    Gawker.com
    Invisionapp.com (via Apollo)
    Kickstarter.com 
    Last.fm
    Linkedin.com
    Linux-mag.com (via QuinStreet)
    LiveAuctioneers.com
    Monster.com (via Apollo)
    Myfitnesspal.com
    Parkmobile.com
    Streeteasy.com
    Teespring.com
    Ticketfly.com
    Ticketmaster.com (via Ticketfly)
    Tumblr.com
    Xbmc.com (via Kodi)

Re: A decade of Have I Been Pwned

#162

Post by marcus0x62 »

cqqxo4zV46cp wrote: post #95
cedilla wrote: post #80

Earlier quoted context omitted.

Wait, a thousand fold decrease is not worth it? Your numbers literally turns a scenario where 200,000 accounts are hacked into one where 200 are exposed. Or one where 30 hacked accounts turn into 0 hacked accounts. There is a point where a difference in quantity becomes a difference in quality. I far prefer the latter scenarios.

Anybody (like GP) that doesn’t understand that this is entirely the nature of security work, should not be making any material decisions about security. The number of times I’ve seen DEVELOPERS neglect to implement materially useful security measures because “they’re not technically perfect!” Is astounding.

The number of times I’ve seen purported security practitioners dismiss materially useful security measures because of some theoretical attack that nobody has ever seen in the wild in recorded history outside of stunt-hacking at Defcon is…probably higher

Re: A decade of Have I Been Pwned

#163

Post by harshbutfair »

Sephr wrote: post #76

I have memories of this site providing me with an excellent experience. Now it's just a cash-grab, asking for $169.50/year just to see 100 breached accounts! I use unique email addresses (breach canaries) on every website to detect when sites leak my data. When I tried to search for my domain results with a previous domain ownership verification, I got hit with this error: "In order to search a domain with any more t…

I do the same thing. I wondered why I hadn't received any breach notifications for a long time, I don't remember seeing a notification of this change.

Re: A decade of Have I Been Pwned

#164

Post by aaronharnly »

yashap wrote: post #138
adameasterling wrote: post #19

Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from crede…

Besides 2FA, rate limiting your login endpoint (both by IP address and username) is a much more robust protection against this attack. Especially if you include temporary bans (e.g. “20 failed login attempts with the same IP, and/or same username, in the past minute = 15 minute ban for that IP and/or username”). A lot of API gateways, K8s ingresses, etc. make this dead simple, and if not it’s also super easy to add w…

Rate limiting definitely helps against credential stuffing in the form of trying a bunch of common passwords against random accounts.

But there's also "stuffing" with known breached username+password combinations – in which case it still helps, but I don't think as much? In the latter the attack is much more likely to succeed and there's a much smaller number of values being attempted, so the threshold of detection + blocking would have to be much lower...

Re: A decade of Have I Been Pwned

#165

Post by solatic »

g_p wrote: post #154
solatic wrote: post #150

Earlier quoted context omitted.

> If you're a young CTO or early-stage engineer working on a web app If you're working on a greenfield login/auth, please don't accept and store passwords in a database! Setup social OAuth, SSO, or magic link emails and make it someone else's problem.

If you do go down this route though, be sure to read up on what you're deploying, and understand what your libraries are doing (and more importantly, not doing). You don't want to end up with a naive implementation of OAuth2 (like some big names had recently) which fails to check the audience parameter, and therefore lets anyone other service using the same SSO gain access to your users' accounts. Recent HN post on t…

I agree, and thanks for pointing that out, but between the two security failures, I'd rather have an incorrect OAuth2 implementation, which can be quickly fixed with no impact on existing customers, than credential stuffing, where I need to email customers apologizing for why I needed to reset their passwords.

Re: A decade of Have I Been Pwned

#166

Post by themoonisachees »

aaronharnly wrote: post #164
yashap wrote: post #138

Earlier quoted context omitted.

Besides 2FA, rate limiting your login endpoint (both by IP address and username) is a much more robust protection against this attack. Especially if you include temporary bans (e.g. “20 failed login attempts with the same IP, and/or same username, in the past minute = 15 minute ban for that IP and/or username”). A lot of API gateways, K8s ingresses, etc. make this dead simple, and if not it’s also super easy to add w…

Rate limiting definitely helps against credential stuffing in the form of trying a bunch of common passwords against random accounts. But there's also "stuffing" with known breached username+password combinations – in which case it still helps, but I don't think as much? In the latter the attack is much more likely to succeed and there's a much smaller number of values being attempted, so the threshold of detection +…

The threshold is lower but in reality it still makes considerably more login attempts, many of them failed, than a normal client ever would. Credential stuffing attacks don't really limit themselves to a single account, even if it worked.

Re: A decade of Have I Been Pwned

#167

Post by another2another »

rockskon wrote: post #51
adameasterling wrote: post #19

Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from crede…

About a decade back, I was at an event that had an FBI employee presenting. During his presentation, he had mentioned a story of a sys admin who had been arrested for taking a hashed PW database in his company, comparing the hashes against known compromised one's (perhaps from haveibeenpwned?), and forced a password reset for everyone who had reused a password that had separately been compromised and sent an email to…

I'm pretty sure the password manager in Safari also checks this db, as I've been warned that some passwords have been discovered in breaches (even going back to the linked in breach).

Re: A decade of Have I Been Pwned

#168

Post by CoffeeOnWrite »

berkes wrote: post #153
twisteriffic wrote: post #144

Earlier quoted context omitted.

> Oh yea I remember HIBP has an online API. Don't use this. That's not the greatest advice IMO. The API gets updated data more frequently, doesn't require that you transmit the password or a useable hashed form, and it's dead simple to consume. I'd argue that it's more effort to maintain an internal store and synchronization infrastructure, and you're less likely to accidentally breach anonymity and leak a weak hash…

Those are good arguments for using an online service. But your conclusion is premature and certainly cannot be made blanket like that in favor of using the API. Just as many arguments can be made for an offline check. Or against an online check. From added latency via required uptime to added dependencies. My point being: no. "It depends"

Well said. I should have said “you don’t have to use the API if you don’t want to” instead of “don’t use this”.

Re: A decade of Have I Been Pwned

#170

Post by Xorakios »

no_wizard wrote: post #128
adameasterling wrote: post #59

Earlier quoted context omitted.

The FBI feeds data into Troy Hunt's database and FBI Director Christopher Wray gave Troy Hunt a medal for his work [1]. The Open Web Application Security Project's Application Security Verification Standard recommends that you do a hashed password check [2]. For bigger companies, sure, go talk to legal, but for young startups, my feeling is it's not worth the $200 or whatever your counsel will charge to say it's ok.…

It is worth it, that $200 dollars gives you lots of credibility to stand on if something should arise and you need to prove diligence, which is not at all uncommon in these cases, if legal recourse is ever saught (unlikely if you do it from day 1, I think, but never the less)

This is my experience totally correct in both California and Florida cases.

Probably closer to $2000 than $200, but paying for an opinion is truthful, helpful and useful.

Kinda sucks that it's necessary

Post reply on HN