Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

31–40 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#31

Post by ericlewis »

danso wrote: post #23

This is an impressive service (the speed, especially)...collation of different data sources into one easily accessible form is a hugely useful and underrated service. That said...there's no such thing as better security without an equal tradeoff. Here, it's now much easier (especially with the site response speed) for a third party to look up email addresses, see who they've patronized, and aggregate them into a data…

Whoa, slow your roll buddy. This could be really easily done by preprocessing the data and creating simple objects in redis. One object = email, sub objects of email could just be flags for the service it's on.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#33

Post by milkmanjr »

oal wrote: post #5

LastPass has a similar service for some of the recent (and not so recent) hacks: * https://lastpass.com/adobe/ * https://lastpass.com/linkedin/ * https://lastpass.com/lastfm/ * https://lastpass.com/eharmony/

Awesome.

The LastPass checker is really nice. Whats scary is that it found a few other people that had the same password as me.

For the Adobe breach, LastPass also emails you a sample of the password hints of others -- its kind of funny how people remember a certain string.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#36

Post by manmal »

mhurron wrote: post #30
aaronblohowiak wrote: post #24

Earlier quoted context omitted.

your email is not a secret.

No, but it can be harvested for directed attacks or spamming. Entering it would basically 'prove' it's a valid address.

The Adobe leaks list is mostly made up of verified emails, so...

Coming to think of it, there has been some spam lately (though that hasn't happened in years now at gmail), and I wonder whether it's related to that Adobe leak.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#37

Post by awj »

chc wrote: post #28
wfunction wrote: post #20

Who's to say these guys aren't stealing our emails?

You can't steal somebody's email just by knowing their address.

If you wanted to collect likely-valid email addresses to sell to spammers, this would be a good way to go about it. I doubt they are, but can understand the suspicion.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#38

Post by danso »

ericlewis wrote: post #31
danso wrote: post #23

This is an impressive service (the speed, especially)...collation of different data sources into one easily accessible form is a hugely useful and underrated service. That said...there's no such thing as better security without an equal tradeoff. Here, it's now much easier (especially with the site response speed) for a third party to look up email addresses, see who they've patronized, and aggregate them into a data…

Whoa, slow your roll buddy. This could be really easily done by preprocessing the data and creating simple objects in redis. One object = email, sub objects of email could just be flags for the service it's on.

It's not the processing that's the bottleneck, it's the gathering and the initiative to do that gathering which is rare. For example, criminal records and notices have always been collectable and, once collectable, searchable. But the incidence of "a prospective employer googled me and found a 5 year old article of me publicly urinating in college" became more of an issue in the age of Google.

This isn't an indictment of Troy at all, just an observation (and I'm also just curious about what mitigation could be done, if any, that wouldn't severely inconvenience the end user). The security that exposed people had was security through obscurity, which is in the end, not enough security.

Post reply on HN