Who's to say these guys aren't stealing our emails?
your email is not a secret.
But its a real email
Have I been pwned? Check if your email has been compromised in a data breach
41–50 of 294 posts
Re: Have I been pwned? Check if your email has been compromised in a data breach
#42I tend to create a new email address for everything I sign up for. This makes a little harder to check :)
EG: twitter@example.com, facebook@example.com, hackernews@example.com
It also makes it a little harder for people to find me on social media. Not sure if that's a bug or a feature ;)
Re: Have I been pwned? Check if your email has been compromised in a data breach
#43Earlier quoted context omitted.
You can't steal somebody's email just by knowing their address.
If you wanted to collect likely-valid email addresses to sell to spammers, this would be a good way to go about it. I doubt they are , but can understand the suspicion.
I doubt they are too, but they should be really proving it somehow.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#44Is this a clever way to harvest email addresses? :)
No
Passwords: I’m not storing them. Nada. Zip. I just don’t need them
and frankly, I don’t want the responsibility either. This is all
about raising awareness of the breadth of breaches.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#45Should I Change my Password is a push service which notifies if your account is compromised and sends you an e-mail to change your credentials [0].
Cool hack btw! The only thing missing is a "What to do" link which could be more useful for folks who are not so technically savy.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#46This is an impressive service (the speed, especially)...collation of different data sources into one easily accessible form is a hugely useful and underrated service. That said...there's no such thing as better security without an equal tradeoff. Here, it's now much easier (especially with the site response speed) for a third party to look up email addresses, see who they've patronized, and aggregate them into a data…
I disagree with your thesis; anyone with malicious intent can be assumed to already have their own copy. Even the Adobe dump is under 4gb compressed - a trivial amount of storage.
Additionally, there is a huge long tail of publicly available user databases that are not included in this site, which along with the lack of hashes makes it worthless for the purpose you envision.
It's also extremely easy to tell if an email is registered on a website if you aren't concerned about the victim being notified. You just need to attempt to either reset the password (it'll say whether the email exists) or register a new account with their email.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#47Is it possible to apply the same hash function to a string as it’s done in the users database of the Adobe breach? I think it is 3DES. I’ve been able to obtain my (hashed) credentials, but as it seems my account is deactivated at adobe.com (probably due to inactivity?), so I’m not able to test which password I used. :(
Re: Have I been pwned? Check if your email has been compromised in a data breach
#48[deleted]
Re: Have I been pwned? Check if your email has been compromised in a data breach
#49LastPass has a similar service for some of the recent (and not so recent) hacks: * https://lastpass.com/adobe/ * https://lastpass.com/linkedin/ * https://lastpass.com/lastfm/ * https://lastpass.com/eharmony/
The crazy thing my simple password was used by 5 other people. Luckily my email password is much more complicated.
Re: Have I been pwned? Check if your email has been compromised in a data breach
#50Earlier quoted context omitted.
No, but it can be harvested for directed attacks or spamming. Entering it would basically 'prove' it's a valid address.
The Adobe leaks list is mostly made up of verified emails, so... Coming to think of it, there has been some spam lately (though that hasn't happened in years now at gmail), and I wonder whether it's related to that Adobe leak.
Ah, but by checking if your email is compromised, they get even more emails then they did just from compromised sources.