Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

391–400 of 470 posts

Re: Two billion email addresses were exposed

#391

Post by esseph »

varispeed wrote: post #219
naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

I bet now some corporations actually want to be exposed, have data breach. If you have not been in the news, it means you have not made it yet (not popular enough to be a target worth writing about).

Those CISOs / CTOs / CIOs attached to those companies do not want to be in the news.

Re: Two billion email addresses were exposed

#392

Post by zazaulola »

jiggawatts wrote: post #330
zazaulola wrote: post #325

Earlier quoted context omitted.

Try Blake3 instead SHA-1 https://github.com/BLAKE3-team/BLAKE3

The sorting is the slowest step by far. Hashing is so fast that you can hand-wave it away as zero cost relative to the time taken to read such a large amount of data. Also, you only have to do it once for the whole input, which means that it's O(n) time where 'n' is the gigabytes of passwords you have. Sorting is going to need about O(n * log n) time even if it's entirely in memory, but more if it has to spool to dis…

What other algorithms have you used? I'm really interested in big data streams. I would like to hear not only successful solutions, but also failed ones. Have you tried using Bloom filters? Is it possible to merge shards using the Min-Heap algorithm?

Re: Two billion email addresses were exposed

#393

Post by froddd »

Thorrez wrote: post #382
froddd wrote: post #376

Earlier quoted context omitted.

The API is not free. https://haveibeenpwned.com/API/v3#Authorisation

Only if you want to search by account. If you want to search by password, it's free. You can query all your passwords to see which ones are breached, and change those. > Authorisation is required for all APIs that enable searching HIBP by email address or domain, namely retrieving all breaches for an account, retrieving all pastes for an account, retrieving all breached email addresses for a domain and retrieving all…

The only part of the API that is free is the passwords API, which would not help for this use case.

Every other endpoint requires a subscription. This is very far from “The API is free”.

> searching by account wouldn't tell you anything useful

The API can return the domains listed in stealer logs for a specific email address: https://haveibeenpwned.com/API/v3#StealerLogsForEmail

Re: Two billion email addresses were exposed

#394

Post by [deleted] »

jorams wrote: post #148

This seems to include details from a Spotify data breach in or before early 2020 that, to my knowledge, was never reported on. They did have other, similar issues that year. Reporting from the time seems to all be about one or multiple leaks/attacks involving: - Credential stuffing with data from other breaches - A leak of data (including email addresses) to "certain business partners" between April 9, 2020 and Novem…

[deleted]

Re: Two billion email addresses were exposed

#395

Post by esseph »

askl wrote: post #345
pil0u wrote: post #314

Earlier quoted context omitted.

With Gmail, also note that firstname.lastname@gmail.com is equivalent to firstnamelastname@gmail.com or fi.rs.tn.am.el.as.tn.am.e@gmail.com As some other comment suggested, these rules are easy to tackle by motivated spammers.

If they were motivated, they wouldn't work as spammers.

Some spammers make obscene amounts of money. CEO of Fortune 100 money.

Re: Two billion email addresses were exposed

#396

Post by mindslight »

EvanAnderson wrote: post #10
worldfoodgood wrote: post #5

The downside to having many vanity urls and giving out a unique email address to each website you visit is that you cannot use haveibeenpwned without paying (despite being a single human). I have no idea how many email addresses I've given out over the years, probably hundreds across at least 6 or 7 domains, and they want to charge me a monthly fee to see which of those have been pwned. I understand they gotta make a…

I'm in the same boat. I track all of the unique addresses I use (via my password manager) so I guess I could just check them all against HiBP's database. Kind of a pain in the ass, though.

Me too. It used to work for whole domains. Then I guess the limit was added as part of some kind of monetization push. I don't derive enough value to pay for a monthly subscription any time it occurs to me to check, nor figure out how to check addresses one-by-one programatically. So the site is basically dead to me now. It's a shame because there were a few breached lists where people were speculating on where exactly they came from, and I was able to add to the discussion based on which of my tagged addresses were in the list.

Re: Two billion email addresses were exposed

#397

Post by junon »

the8472 wrote: post #346
junon wrote: post #53

Earlier quoted context omitted.

https://haveibeenpwned.com/Passwords

This doesn't help. If the email address check says the address has been exposed it doesn't tell you which password that was used together with that has been exposed. Was it one from 10 years ago you don't even remember? Or that's still actively in use? Which one of my hundreds of passwords?

It doesn't matter, don't use passwords that have been compromised. Period.

Re: Two billion email addresses were exposed

#399

Post by junon »

ekjhgkejhgk wrote: post #243
windsurfer wrote: post #238

Earlier quoted context omitted.

You can download the entire dataset using curl (will be 40+ GB) curl -s --retry 10 --retry-all-errors --remote-name-all --parallel --parallel-max 150 "https://api.pwnedpasswords.com/range/{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}{0,1,2,3,4,5,6,7,8,9,A,B,C,D,E,F}"

It's not that I couldn't have written that oneliner, it's that I assumed you'd get blocked very quickly.

You are being purposefully obtuse here. HIBP is a very, very well established site with a long history of operating in good faith.

Re: Two billion email addresses were exposed

#400

Post by ekjhgkejhgk »

junon wrote: post #399
ekjhgkejhgk wrote: post #243

Earlier quoted context omitted.

It's not that I couldn't have written that oneliner, it's that I assumed you'd get blocked very quickly.

You are being purposefully obtuse here. HIBP is a very, very well established site with a long history of operating in good faith.

> > It's not that I couldn't have written that oneliner, it's that I assumed you'd get blocked very quickly.

> junon https://news.ycombinator.com/user?id=junon

> You are being purposefully obtuse here. HIBP is a very, very well established site with a long history of operating in good faith.

Allowing people to query and someone downloading the entire dataset is normally considered abuse, so being blocked is the expectation here. You're so dense you're bending light around you.

Post reply on HN