Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

251–260 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#251

Post by pawelk »

pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

> Looks like I got caught up in the adobe breach.

I knew I was, but I was delighted by what Dreamhost did: they have cross-checked their users' e-mails with the Adobe leaked database and sent a message [1] to affected users explaining the situation and advising to change the passowrd, reminding to not re-use passwords and suggesting password vaults.

I think it's a great thing to do by third-parties when leaks of this magnitude happen.

[1] Full text: http://pastebin.com/2AkU0v98

Re: Have I been pwned? Check if your email has been compromised in a data breach

#252

Post by philipb »

0utsider89 wrote: post #156

This site is BS, I put in a BS email still say I was part of a adobe password breach!!!

even if it was a BS email, it could have been a part of the db. you'd be surprised at the kind of BS email address in the adobe dump. there are ~1K people who provided an @a.com email address.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#253

Post by Nilzor »

vacri wrote: post #238
cynwoody wrote: post #161

Earlier quoted context omitted.

I got three hits for president@whitehouse.gov.

People put in bogus addresses when they register for things. I have a domain that is similar to a common mash on the keyboard, and I get a steady stream of backscatter from people signing up to things with crap@keyboardmash.org.

asdf.com? qwerty.org? Please don't leave us hanging :P

Re: Have I been pwned? Check if your email has been compromised in a data breach

#255

Post by Gyy0 »

This is what caused me to start using a password manager. I always knew that I should, but it seemed to be a major pain, if I had known how convenient it is, I would have switched to it long back.

Instead I first started off with my own "password generator":

    import random
    import string
    import sys

    def generate_random(length, simple):
        chars = string.printable[:-6] if not simple else string.letters + string.digits
        return ''.join(random.sample(chars, 1)[0] for x in range(length))

    def username():
        return generate_random(length=4, simple=True)

    def password(length):
        return generate_random(length=length, simple=False)

    if __name__ == '__main__':
        length = 6
        if len(sys.argv) > 1 and sys.argv[1].isdigit():
            length = int(sys.argv[1])

        for i in range(20):
            print username(), password(length)

Re: Have I been pwned? Check if your email has been compromised in a data breach

#258

Post by chewit »

esurc wrote: post #224
graeme wrote: post #108

Earlier quoted context omitted.

Anyone know what adobe's password requirements were? I don't know which password I used there: Adobe forced me to change it without letting me test the old one.

For the Adobe breach specifically, you might try the site set up by Last Pass, which checks your email against the breached data: https://lastpass.com/adobe/ The added feature is that, if your email is in the list, Last Pass will share with you how many others had your same password -- and the list of all password hints associated with that password. If more than a handful of others used the same password, that shoul…

This is beautiful. Thank you so much. I'd been getting really frustrated not knowing which passwords I'd needed to change but my hint was enough!

Re: Have I been pwned? Check if your email has been compromised in a data breach

#259

Post by antihero »

gmisra wrote: post #114
da_n wrote: post #73

Earlier quoted context omitted.

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

I am surprised by how few people are aware of this: https://www.pwdhash.com/ Convenience provided via Chrome/Firefox extensions, portability provided by the website.

Eh, that's awesome. There's an Android app, too, so I can use this on my phone.

They don't seem to mention anywhere which hashing algorithm they use. Also, the lengths are quite small. Any idea why?

Re: Have I been pwned? Check if your email has been compromised in a data breach

#260

Post by fuzzix »

da_n wrote: post #73
pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

I generate passwords with something like:

printf "/" ; openssl rand -base64 32 | sed 's/.$//'

The leading slash was a nice tip someone gave me to not echo if you accidentally paste the password into IRC... Though if the password itself contains a slash then your client won't consider it a command and will echo it anyway, so do what you will.

Anyway, each new account gets a new password you couldn't beat out of me, though you could probably get my password safe phrase, so do what you will.

Generating long passwords like this highlights providers who enforce password length limits. Paypal's limit is ludicrously short. Hetzner's is limited too.

edit more guff.

Post reply on HN