Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

201–210 of 470 posts

Re: Two billion email addresses were exposed

#201

Post by Aeolun »

Xerox9213 wrote: post #83
eyeundersand wrote: post #46

Earlier quoted context omitted.

+1 for Bitwarden. It is literally the best solution out there. Been getting to increase uptake in personal circles with (very) limited success. The wife keeps trying to convince me that the ship has sailed in trying to protect info online. She's probably right.

I convinced my wife to start using a password manager, too (Bitwarden). Now she stores all of her very guessable, short, similar passwords in a manager. Sigh.

So happy to not have to remember whether the [firstname][lastname][number] password ended with a 4 or 5

Re: Two billion email addresses were exposed

#202

Post by neogodless »

esnard wrote: post #143
neogodless wrote: post #123

Earlier quoted context omitted.

I use unique email addresses per domain name, and I believe IHaveBeenPwned shows me at 39 unique email addresses breached! (So many that seeing which ones have been breached would now cost me $22 / month... IHaveBeenPwned is starting to feel like an extortion racket of its own..)

If you're using the same domain for each of your email address, HIBP has a domain-wide search feature which is free (but you need to register to validate your domain)

I've registered (years and years ago) and I get emails saying how many, but to see which emails they want lots of money.

(If I'm wrong their interface is very confusing and I cannot find the free access.)

Specifically it says this:

> Insufficient subscription. Only subscription-free breaches will be returned for this domain.

So I'm able to see 37 email addresses on my domain have been breaches, but I can't see which without paying $22 / month - https://haveibeenpwned.com/Subscription

> Domain search restricted: You don't have an active subscription so you're limited to searching domains with up to 10 breached addresses (excluding addresses in spam lists). Only results for subscription-free breaches are shown below, upgrade your subscription to run a complete domain search. If you believe you're seeing this message in error, make sure you're signing in to the dashboard with the correct email address (check your latest receipt if you're unsure).

Re: Two billion email addresses were exposed

#203

Post by jacquesm »

I totally respect Troy and the work he's doing, but I still can't justify to myself the risk of typing my passwords into his website because that would be the very first time that I would use any of those in places other than the ones where I normally use them.

Is there a way around this?

Edit: to answer my own question, I should read a bit more rather than click on the first link, the answer is here:

https://haveibeenpwned.com/API/v3?ref=troyhunt.com#PwnedPass...

Which uses:

https://en.wikipedia.org/wiki/K-anonymity

Re: Two billion email addresses were exposed

#204

Post by Aeolun »

WaitWaitWha wrote: post #105
kulahan wrote: post #45

Earlier quoted context omitted.

I was in the military. China stole my freaking DNA profile . I've given up on worrying about this stuff.

The number of years I got "free credit monitoring" I can pass it down to my children . . .

I feel like only in the US is credit monitoring something sold as an optional service.

I got a confirmation mail from System76, because apparently they feel the need to validate my credit card can’t be used without my approval, but my back does this by default…

Re: Two billion email addresses were exposed

#205

Post by toast0 »

osculum wrote: post #103
EvanAnderson wrote: post #66

Earlier quoted context omitted.

Interesting. I'd love to see where you're seeing that. I'll go poke at the site a little more. Edit: When I try to do a domain search I get told: > Domain search restricted: You don't have an active subscription so you're limited to searching domains with up to 10 breached addresses (excluding addresses in spam lists). My domain has 11 breached addresses.

I log in. Click on Business -> Domains. Then click on the looking glass under "Actions" on my domain. I can there see all my addresses an Pwned Sites. But I think you are right, because I only have 3 breached addresses under my domain (I do see the 10 addresses wording under subscriptions)

Yep, if you have the good fortune of having many breaches while using companname@example.org, the service requires that either you pay up or you have to guess and check.

I understand, but it's frustrating.

Re: Two billion email addresses were exposed

#206

Post by worldfoodgood »

username44 wrote: post #49
kccqzy wrote: post #33

Earlier quoted context omitted.

The domain search feature on haveibeenpwned is/was free. I registered my domain on haveibeenpwned back in 2017 and I got two emails about breaches, one in 2020 and another in 2022. I did not pay.

I wasn’t aware of this feature, but can confirm. Just tried and it is free. Log into dashboard, under business there is a domains tab. Enter your domain there and verify ownership. Didn’t ask for payment.

I have 15 pwned email addresses. It's free for under 10.

Re: Two billion email addresses were exposed

#207

Post by worldfoodgood »

kccqzy wrote: post #33
worldfoodgood wrote: post #5

The downside to having many vanity urls and giving out a unique email address to each website you visit is that you cannot use haveibeenpwned without paying (despite being a single human). I have no idea how many email addresses I've given out over the years, probably hundreds across at least 6 or 7 domains, and they want to charge me a monthly fee to see which of those have been pwned. I understand they gotta make a…

The domain search feature on haveibeenpwned is/was free. I registered my domain on haveibeenpwned back in 2017 and I got two emails about breaches, one in 2020 and another in 2022. I did not pay.

It is only free if you have fewer than 10 pwned addresses.

Re: Two billion email addresses were exposed

#208

Post by arealaccount »

jacquesm wrote: post #203

I totally respect Troy and the work he's doing, but I still can't justify to myself the risk of typing my passwords into his website because that would be the very first time that I would use any of those in places other than the ones where I normally use them. Is there a way around this? Edit: to answer my own question, I should read a bit more rather than click on the first link, the answer is here: https://haveibe…

DM me your passwords Ill do it for you

Re: Two billion email addresses were exposed

#209

Post by echelon »

hombre_fatal wrote: post #176
eyeundersand wrote: post #46

Earlier quoted context omitted.

+1 for Bitwarden. It is literally the best solution out there. Been getting to increase uptake in personal circles with (very) limited success. The wife keeps trying to convince me that the ship has sailed in trying to protect info online. She's probably right.

Now that I'm not only using a Macbook and iPhone, I've been looking for cross-platform solutions. For a week I've been using KeePassXC + Syncthing between four devices. Syncthing is also syncing my Obsidian vaults which has replaced Apple-only Notes.app. Bitwarden is definitely more polished, and Syncthing is definitely (much) more fiddly than using Bitwarden's and Obsidian's ($5/mo) native syncing tools. But I like…

> Now that I'm not only using a Macbook and iPhone, I've been looking for cross-platform solutions.

1password works in all the places, it's just not open source.

Re: Two billion email addresses were exposed

#210

Post by worldfoodgood »

TZubiri wrote: post #166
worldfoodgood wrote: post #5

The downside to having many vanity urls and giving out a unique email address to each website you visit is that you cannot use haveibeenpwned without paying (despite being a single human). I have no idea how many email addresses I've given out over the years, probably hundreds across at least 6 or 7 domains, and they want to charge me a monthly fee to see which of those have been pwned. I understand they gotta make a…

You need a domain, and possibly a paid mail provider with catch all support. So cost was always part of this strategy

I have those things? Did you miss the part where I have multiple vanity URLs and hundreds of email addresses? Of course I have a paid mail provider and catch all. The problem is the cost of haveibeenpwned is too much for me as an individual.
Post reply on HN