It says I haven't, yet if I google my email and an older password I used to use, I find it listed on some Russian forum.
Have I been pwned? Check if your email has been compromised in a data breach
181–190 of 294 posts
Re: Have I been pwned? Check if your email has been compromised in a data breach
#182Earlier quoted context omitted.
This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.
I am surprised by how few people are aware of this: https://www.pwdhash.com/ Convenience provided via Chrome/Firefox extensions, portability provided by the website.
I like https://oneshallpass.com/ better since it lets you change some attributes about the passwords generated. So if a site is compromised you can just increment the generation field and get a totally new hash.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#183Is this a trap to build a mailing list? I tried a bunch of fake hotmail emails and 90% of them are "pwned". Very suspicious to say the least.
This sounds as much of a trap as do the websites that tells "how secure is your password" to use them to build dictionaries for brute force.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#184I tend to create a new email address for everything I sign up for. This makes a little harder to check :) EG: twitter@example.com, facebook@example.com, hackernews@example.com It also makes it a little harder for people to find me on social media. Not sure if that's a bug or a feature ;)
That's actually a very unadvisable scheme. By doing this you make yourself a target. If any one of those are compromised, attackers will attempt to try that against a lot of popular sites (including banks). If you have your own domain (which I assume you do based on your scheme), I suggest not doing this. You would be better off coming up with a random account name for each and using a password manager to keep track…
The key motivation is not security, but if any account starts receiving spam, I will have a good idea where it is coming from. It also lets me shut off mail from any source.
Some services will use that as the username, others allow me to pick my own. Using a password manager helps this whole scheme. Now that I do that, I could go to random email addresses and usernames.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#185Earlier quoted context omitted.
That's actually a very unadvisable scheme. By doing this you make yourself a target. If any one of those are compromised, attackers will attempt to try that against a lot of popular sites (including banks). If you have your own domain (which I assume you do based on your scheme), I suggest not doing this. You would be better off coming up with a random account name for each and using a password manager to keep track…
the downside is that using random accounts on your domain requires a catch-all email rules on your server (unless you add each address by hand, but frankly that's too much of a hassle)
I never use a catch-all. Deleting email would quickly exceed available time.
I go through the trouble of creating a new email each time. I've considered writing a script to make it easier, but my current mail provider makes that difficult.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#186For the last 12 years or so I've been using unique email addresses. I have a catchall domain and established patterns for giving out email addresses. Over the years I've witnessed many companies either getting hacked or selling out their mailing list. I know this because I start to receive spam to these unique email addresses.
Just this morning I discovered that Sirius XM has been hacked. Shame.
It would make an interesting project to analyze all this history that I've built up.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#187Re: Have I been pwned? Check if your email has been compromised in a data breach
#188Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…
This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.
Crap, looks like my wife's email was caught up in the Adobe breach. I think she created an account for reading ebooks with Adobe DRM downloaded from our library.
Consider this a heads up for married HN'ers, you should check their emails too.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#189Earlier quoted context omitted.
One of my addresses was also in the Adobe breach. No idea what password I used there, but I'm fairly sure it must have been either my common "junk" password, shared with tons of forums, but nothing that poses any serious risk to me (just to those forums). Or if they had stricter requirements, some variation on it that I always forget, so I have to ask them for a new password every time anyway. I certainly don't reuse…
If you're using a forum, outré in front of a computer. Keeping track of things is one of the things computers are _best_ at. Get yourself a password manager. I use 1Password, but I hear good things about KeyPass and LastPass too. Seriously - you can't manage 2013 grade password complexity requirements for all the places you need passwords in your head any more (it's likely you never could…) Get a tool to help, comput…
I've got KeePass, but I haven't used it remotely as long as I've used many websites. Also, I don't have my KeePass DB in Dropbox, so I can't access it from other computers.
More than that, I'd rather not put my KeePass DB on someone else's machine in the first place. But I'll easily trust strange computers with a password for some crappy forum.
There's always something you risk compromising. I prefer some forum account to be compromised.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#190Earlier quoted context omitted.
This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.
What do you do when you are using a different computer and need to login to site?
My first question would be "how often does that really happen?". It's a legitimate concern at first sight, but for me, I pretty much never need to do that since I always have my phone with me.
But if I do need to, I have 1Password on my phone as well and can get the passwords from it.