Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

211–220 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#211

Post by jason_slack »

benjamincburns wrote: post #208
jason_slack wrote: post #142

Earlier quoted context omitted.

Well, I wasn't joking, but I didn't realize md5 was as vulnerable as Atwood says it is. SHA-2 or Bcrypt.

Sorry, that was overly snarky and that wasn't warranted. Are you talking about how you store your own passwords so that you may retrieve them in order to log into some service, or are you talking about how you store user credentials as part of an application? If you're storing your own passwords, just use a well-rated password locker program, or store them in a TrueCrypt volume or similar. If you're storing your user…

no, I am just storing my passwords in a text file and I don't want to do it plaintext, but I also don't want to have to encode the whole text file and have to decode it first to use it. Just make it more complicated if someone opens it.

Thanks for the reminder of ticks (`) I was accidentally using single quotes (')

Re: Have I been pwned? Check if your email has been compromised in a data breach

#212

Post by eternalban »

dredmorbius wrote: post #52
mhurron wrote: post #30

Earlier quoted context omitted.

No, but it can be harvested for directed attacks or spamming. Entering it would basically 'prove' it's a valid address.

On a risk / reward basis the benefit to checking here is actually pretty high. I don't find any of several accounts I use on there, but did find a friend's email listed (and just notified him). I'd actually appreciate a way to query my mailing list in an automated fashion.

Did your friend have an input on the the risk/reward decision?

Re: Have I been pwned? Check if your email has been compromised in a data breach

#213

Post by legohead »

gojomo wrote: post #200

Feature request: allow wildcard searches, with a sufficiently large literal starting prefix, to return a simple "zero" or "more-than-one" result. EG: "john*@gmail.com" I'd then feel better about typing my address into a random site, and be able to check site-specific variants of my address more easily.

Yes!

For every different site I use a different email address, so I know when something fishy is going on. so I might have hackernews@mydomain.com. The form wont accept just @domainname.com :(

Re: Have I been pwned? Check if your email has been compromised in a data breach

#214

Post by john2x »

Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

I do the same, and my "core" is less obscure than yours. I'm worried. What is this cracklib thing? Do I just provide it my password and it tells me stuff?

Re: Have I been pwned? Check if your email has been compromised in a data breach

#215

Post by jychang »

_xo_ wrote: post #207
aimhb wrote: post #157

Earlier quoted context omitted.

You can just torrent users.tar.gz (the leaked list of encrypted passwords) and then grep the file for your email address, which will give you the encrypted version of your password.

...which does not really help without the crypto-key - even if you know a list of possible passwords you cannot test them.

Well, funnily enough, if you know your password and it was in the leak, you can test it against your own password.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#217

Post by benjamincburns »

jason_slack wrote: post #211
benjamincburns wrote: post #208

Earlier quoted context omitted.

Sorry, that was overly snarky and that wasn't warranted. Are you talking about how you store your own passwords so that you may retrieve them in order to log into some service, or are you talking about how you store user credentials as part of an application? If you're storing your own passwords, just use a well-rated password locker program, or store them in a TrueCrypt volume or similar. If you're storing your user…

no, I am just storing my passwords in a text file and I don't want to do it plaintext, but I also don't want to have to encode the whole text file and have to decode it first to use it. Just make it more complicated if someone opens it. Thanks for the reminder of ticks (`) I was accidentally using single quotes (')

Ah, then I stand by my original advice. Keep in mind, base64 encoded ascii/UTF-8/whatever encoding you like is still plaintext. If you want to be secure, use a password locker program or store them in a text file inside of a small encrypted volume which you unmount as soon as you're done with it (TrueCrypt is nice for this).

But if you don't care about them actually being secure, party on...

Aside from backticks, you can also use the dollar quote (I'm sure this has a better name):

   $(some_command some arguments | some_other_command)
Finally, back to the original "how do I combine this with md5" question, you don't, as that won't do what you want. That is, you want to be able to recover the plaintext, but cryptographic hashes are designed specifically to make that practically impossible.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#218

Post by thrill »

walden42 wrote: post #195
pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

Yahoo here. How the hell did the hackers get the passwords in plain text? Were they seriously unencrypted?

They were encrypted, but with no variation between the hashes for per email. https://lastpass.com/adobe/ will show you the password hints associated with the (in my case) 200 people with the same (hashed) password. The clues would be sufficient to guess the password.

I've gone to generating a unique password with a simple random number generator if the end site supports password recovery (in case Chrome's password memorizing system forgets it).

#!/bin/bash if [ $1 ] ; then a=$1 else a=16 fi dd if=/dev/urandom bs=1000 count=1 2>/dev/null | tr -d -c "[:alnum:]" | tr -d '`' | tr -d "'" | tr -d '"' | tr -d '\\' | head -c $a echo

Re: Have I been pwned? Check if your email has been compromised in a data breach

#219

Post by Udo »

john2x wrote: post #214
Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

I do the same, and my "core" is less obscure than yours. I'm worried. What is this cracklib thing? Do I just provide it my password and it tells me stuff?

It's a linux library that checks passwords against a database of known words and patterns. You give it a password and it gives you basically one of two answers: "this is based on a known word" or "nope, never seen anything like it before". The database format looks highly obscure and doesn't lend itself to grepping without much effort.
Post reply on HN