Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

231–240 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#231

Post by peferron »

tlrobinson wrote: post #221
Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

Is there an easy way to check a password using cracklib via the command line? Preferably on OS X.

  brew install cracklib cracklib-words

  echo "lol" | cracklib-check

Re: Have I been pwned? Check if your email has been compromised in a data breach

#232

Post by code_duck »

The email I used for Adobe was caught in their breach. Good news? I not only used a different password, but I use a new email for almost every site. I have a wildcard email and Adobe is the only site I've ever used that particular email on. Meanwhile, my yahoo account (which I basically use for nothing) is not listed as being exposed, but I logged into that recently and had a note that it had recently been logged into from India. Good golly.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#233

Post by overgard »

basch wrote: post #117
Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

whynotjustusereallylongpasswordsthatarehardformachinestocrack?

Passphrases are a really good idea, but a lot of sites have very short length limits.

Granted if they have limits thats a really big red flag that they're storing your password in plain text, as a hash should always be the same length, so you probably shouldn't sign up there anyway. I remember a few years ago I was signing up for a TD account, and about 5 pages through the signup page it wouldn't allow me to continue because my password was /too secure/ (not their exact wording, but that was basically the problem). What makes it funnier is a lot of sites would reject the password I used at the time as not being secure enough.

I stopped signing up at that point, but I remember getting a phone call (!) from them a couple days later asking why I didn't finish the sign up, and my answer was: because I'm not giving my money to a company that doesn't know how to store passwords!

Re: Have I been pwned? Check if your email has been compromised in a data breach

#234

Post by bricestacey »

prawn wrote: post #230
bentcorner wrote: post #188

Earlier quoted context omitted.

Crap, looks like my wife's email was caught up in the Adobe breach. I think she created an account for reading ebooks with Adobe DRM downloaded from our library. Consider this a heads up for married HN'ers, you should check their emails too.

In Australia, both my wife and I got mailed out letters from Adobe regarding our accounts being potentially compromised. Did that happen elsewhere as well?

Got the same one -- USA

Re: Have I been pwned? Check if your email has been compromised in a data breach

#235

Post by bcuccioli »

Feature request: Could you strip the dots from user input if the email address is @gmail.com, and similarly strip the dots from the records of pwned email addresses? Gmail usernames are dot agnostic, and I sometimes use xyz@gmail.com, x.yz@gmail.com, etc. This makes it hard to use the tool to check of my Gmail has been pwned. (Also, I assume you don't do this already).

Re: Have I been pwned? Check if your email has been compromised in a data breach

#236

Post by DigitalSea »

This site has done a good job highlighting just how badly Adobe screwed up with their data breach. Everyone in my office had their email address show up from the Adobe breach (including mine) and based on the comments, everyone else mostly did as well. Whoa.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#237

Post by vacri »

rfnslyr wrote: post #57
cleaver wrote: post #42

I tend to create a new email address for everything I sign up for. This makes a little harder to check :) EG: twitter@example.com, facebook@example.com, hackernews@example.com It also makes it a little harder for people to find me on social media. Not sure if that's a bug or a feature ;)

Same here, with completely randomized passwords 60 chars long and different emails. IM INVISIBLE!

How many proxies are you behind? :)

Re: Have I been pwned? Check if your email has been compromised in a data breach

#238

Post by vacri »

cynwoody wrote: post #161
0utsider89 wrote: post #156

This site is BS, I put in a BS email still say I was part of a adobe password breach!!!

I got three hits for president@whitehouse.gov.

People put in bogus addresses when they register for things. I have a domain that is similar to a common mash on the keyboard, and I get a steady stream of backscatter from people signing up to things with crap@keyboardmash.org.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#239

Post by im3w1l »

baby wrote: post #223
Aldo_MX wrote: post #85

Earlier quoted context omitted.

catchall FTW I follow the following pattern with websites: If the website is important (ex. government), I use @ . My filtering rules are extremely strict, and every mail that doesn't come from the expected website gets automatically flagged as spam and deleted. If their DB leaks, I just change the 4 numbers. If I know the website and it's not an startup, I use @ , ex. facebook@example.com. My filtering rules only fl…

This seems way too difficult to manage. I wish there was a Gmail like application that anyone could set up easily on its server and that would allow for : quick email generation. You need to sign up to something ? Generate a quick mail that redirects automatically to your main inbox and that you can give away when signing up. If you see that spam is arriving on this email, remove it.

baby+hackernews12345@gmail.com Goes to the inbox of user baby

Re: Have I been pwned? Check if your email has been compromised in a data breach

#240

Post by sb23 »

overgard wrote: post #233
basch wrote: post #117

Earlier quoted context omitted.

whynotjustusereallylongpasswordsthatarehardformachinestocrack?

Passphrases are a really good idea, but a lot of sites have very short length limits. Granted if they have limits thats a really big red flag that they're storing your password in plain text, as a hash should always be the same length, so you probably shouldn't sign up there anyway. I remember a few years ago I was signing up for a TD account, and about 5 pages through the signup page it wouldn't allow me to continue…

In Australia, our "welfare" system is taken care of by Centrelink. They have all of your personal details, as well as access to the amount you're getting per fortnight, and job history, resume etc. Lots of stuff you don't want compromised.

They also limit your password to 8 characters.

This is a huge government website that heaps of Australians have to access at least fortnightly.

Post reply on HN