Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are discontinuing the dark web report

support.google.com

Post reply on HN
Print view View original

41–50 of 61 posts

Re: We are discontinuing the dark web report

#41

Post by thaumasiotes »

liquidgecka wrote: post #40
prepend wrote: post #11

I found the info not actionable because it wouldn’t say what actual values were posted. I have a common name Gmail account. The password is rather complex and I would be surprised if it leaks as only I and Google know it. However, I would get reports that it’s on the dark web with blanked out password values. So I never knew if they actually compromised or just something else. They would also report when some random…

Yeah.. I have a five letter email that's a common first and last name @ gmail.com. I second everything you said. Getting report hits every few days are useless given how few sites do any kind of validation. :-/

> I have a five letter email that's a common first and last name @ gmail.com.

What are the common two-letter first or last names?

Re: We are discontinuing the dark web report

#42

Post by tczMUFlmoNk »

thaumasiotes wrote: post #41
liquidgecka wrote: post #40

Earlier quoted context omitted.

Yeah.. I have a five letter email that's a common first and last name @ gmail.com. I second everything you said. Getting report hits every few days are useless given how few sites do any kind of validation. :-/

> I have a five letter email that's a common first and last name @ gmail.com. What are the common two-letter first or last names?

Ng, Le, Li, Lu, Wu, Xu, Xi, Fu… come to mind immediately for last names.

For first names… Jo, Ty, Al, maybe?

Re: We are discontinuing the dark web report

#43

Post by Terr_ »

deepsun wrote: post #37
placatedmayhem wrote: post #34

Earlier quoted context omitted.

Or, use a service that lets you generate an address for each business you deal with or use case you have so you can treat them as disposable. After chasing down spammers and companies selling my info, including my email, I found this was easier to keep up with and is more effective. Spam me once or sell it to another company, and I burn that address, replacing it with the original company if I really need them to kee…

I tried to do that but found out there's almost no services that I would want to treat my account there disposable. If I bother to provide them my email address -- I usually also want to access my account there later (e.g check order status). There are tens of services where I'd like it disposable, but hundreds of services where account is warranted. And some of those thousands will be compromised some day.

I'd distinguish between an address one can choose to dispose of in an organized way versus an account you don't want to lose access to.

I have my own domain, and pay a hosting company to manage the e-mail, which means it's easy to have ton of forwarding-only addresses for different purposes.

This means that I register with mybank123@domain, if that ever leaks I can log in with them and change my e-mail to a new forwarding-address of mybank456@domain. Then retire the older one.

Re: We are discontinuing the dark web report

#44

Post by nomilk »

prepend wrote: post #11

I found the info not actionable because it wouldn’t say what actual values were posted. I have a common name Gmail account. The password is rather complex and I would be surprised if it leaks as only I and Google know it. However, I would get reports that it’s on the dark web with blanked out password values. So I never knew if they actually compromised or just something else. They would also report when some random…

> I found (it) not actionable

Tangental, but I found 'Have I Been Pwned' useless too because you can't enter your email and find leaked passwords associated with the address, instead you have to enter each password (and repeat for every password you want to check).

I know there's an explanation that the raw password is not being sent and instead being hashed locally and only part of the hash is sent. But I don't know how to verify that and it feels wild to type passwords into a random website. (if anyone knows how to verify HIBP does only what it says it does [rather than blindly trust and hope for the best], would love to read more about it)

Re: We are discontinuing the dark web report

#45

Post by bobthepanda »

tczMUFlmoNk wrote: post #42
thaumasiotes wrote: post #41

Earlier quoted context omitted.

> I have a five letter email that's a common first and last name @ gmail.com. What are the common two-letter first or last names?

Ng, Le, Li, Lu, Wu, Xu, Xi, Fu… come to mind immediately for last names. For first names… Jo, Ty, Al, maybe?

If you have a two letter last name you need a three letter first name to make five. Joe, Bob, Sam, etc.

Re: We are discontinuing the dark web report

#46

Post by culi »

nomilk wrote: post #44
prepend wrote: post #11

I found the info not actionable because it wouldn’t say what actual values were posted. I have a common name Gmail account. The password is rather complex and I would be surprised if it leaks as only I and Google know it. However, I would get reports that it’s on the dark web with blanked out password values. So I never knew if they actually compromised or just something else. They would also report when some random…

> I found (it) not actionable Tangental, but I found 'Have I Been Pwned' useless too because you can't enter your email and find leaked passwords associated with the address, instead you have to enter each password (and repeat for every password you want to check). I know there's an explanation that the raw password is not being sent and instead being hashed locally and only part of the hash is sent. But I don't know…

Well of course a hostile actor could use this incredibly accessible resource to test a bunch of emails and find their passwords.

Though perhaps there could be a service where you enter in an email address and it sends an email to that address containing the passwords. That would be a slightly more complicated server to set up though

Re: We are discontinuing the dark web report

#47

Post by clarionbell »

nomilk wrote: post #44
prepend wrote: post #11

I found the info not actionable because it wouldn’t say what actual values were posted. I have a common name Gmail account. The password is rather complex and I would be surprised if it leaks as only I and Google know it. However, I would get reports that it’s on the dark web with blanked out password values. So I never knew if they actually compromised or just something else. They would also report when some random…

> I found (it) not actionable Tangental, but I found 'Have I Been Pwned' useless too because you can't enter your email and find leaked passwords associated with the address, instead you have to enter each password (and repeat for every password you want to check). I know there's an explanation that the raw password is not being sent and instead being hashed locally and only part of the hash is sent. But I don't know…

I always thought that it could be reasonably simple to have a safe alternative. Have people enter a SHA256 of their password instead, and match against a database of other hashes.

Almost everyone interested in checking for password leaks knows how to generate SHA256 of a string. And those who don't shouldn't put their passwords on the internet.

Or even better, generate hash for all passwords in the database, package these hashes together with a simple search script and let people download it. That way, you are not sending any information anywhere, and noone can exploit the passwords, because hash is a one way function.

Then again, that download could be really large. I admit I have no idea how much storage would that take. But it's just text, so easily compressible. And with some smart indexing, it should be possible to keep most compressed and only unpack a relatively small portion to find a complete match.

Then again, I have virtually no background in cryptography, could be something horribly wrong with this.

Re: We are discontinuing the dark web report

#48

Post by [deleted] »

clarionbell wrote: post #47
nomilk wrote: post #44

Earlier quoted context omitted.

> I found (it) not actionable Tangental, but I found 'Have I Been Pwned' useless too because you can't enter your email and find leaked passwords associated with the address, instead you have to enter each password (and repeat for every password you want to check). I know there's an explanation that the raw password is not being sent and instead being hashed locally and only part of the hash is sent. But I don't know…

I always thought that it could be reasonably simple to have a safe alternative. Have people enter a SHA256 of their password instead, and match against a database of other hashes. Almost everyone interested in checking for password leaks knows how to generate SHA256 of a string. And those who don't shouldn't put their passwords on the internet. Or even better, generate hash for all passwords in the database, package…

[deleted]

Re: We are discontinuing the dark web report

#49

Post by eXpl0it3r »

clarionbell wrote: post #47
nomilk wrote: post #44

Earlier quoted context omitted.

> I found (it) not actionable Tangental, but I found 'Have I Been Pwned' useless too because you can't enter your email and find leaked passwords associated with the address, instead you have to enter each password (and repeat for every password you want to check). I know there's an explanation that the raw password is not being sent and instead being hashed locally and only part of the hash is sent. But I don't know…

I always thought that it could be reasonably simple to have a safe alternative. Have people enter a SHA256 of their password instead, and match against a database of other hashes. Almost everyone interested in checking for password leaks knows how to generate SHA256 of a string. And those who don't shouldn't put their passwords on the internet. Or even better, generate hash for all passwords in the database, package…

That's already what is happening...

When you do a check on https://haveibeenpwned.com/Passwords nothing is sent to the server. Instead the password is hashed locally and a list of the hash range is downloaded, which contains all the hashes and the number of occurrences.

The server doesn't receive the password, neither in plain-text nor hash form.

Re: We are discontinuing the dark web report

#50

Post by godelski »

eXpl0it3r wrote: post #49
clarionbell wrote: post #47

Earlier quoted context omitted.

I always thought that it could be reasonably simple to have a safe alternative. Have people enter a SHA256 of their password instead, and match against a database of other hashes. Almost everyone interested in checking for password leaks knows how to generate SHA256 of a string. And those who don't shouldn't put their passwords on the internet. Or even better, generate hash for all passwords in the database, package…

That's already what is happening... When you do a check on https://haveibeenpwned.com/Passwords nothing is sent to the server. Instead the password is hashed locally and a list of the hash range is downloaded, which contains all the hashes and the number of occurrences. The server doesn't receive the password, neither in plain-text nor hash form.

They meant you submit the checksum instead of your password. Replace "Password to check" with "Checksum to check"
Post reply on HN