Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

411–420 of 470 posts

Re: Two billion email addresses were exposed

#411

Post by Marsymars »

ratherbefuddled wrote: post #320
Marsymars wrote: post #227

Earlier quoted context omitted.

In most cases a true second factor isn't really what any involved party cares about. My bank (I mean, they use SMS, but pretend they use TOTP) just care about not having to spend money on support because I used "password1!" as my password for every account and lose all my money. I just want to log in to my bank. If I've got a long, random, unique, securely-stored password, I don't actually care about having a second…

> If I've got a long, random, unique, securely-stored password, I don't actually care about having a second factor I'm not comfortable with my entire online identity being protected by a single line of defence which is a company that I'm paying a few dollars a month to. Not having to type 6 digits off a phone is a pretty minor convenience for me.

Do you then avoid syncing any passwords to your phone to avoid having your two factors in the same place? (And similarly, avoid syncing SMS to any devices where you do have passwords.)

Re: Two billion email addresses were exposed

#412

Post by worldfoodgood »

NetMageSCW wrote: post #293
guelo wrote: post #61

Earlier quoted context omitted.

I have the more typical one email used with hundreds of passwords on many websites. haveibeenpwned is also useless for me, it will tell me that my email was compromised but not which sites or passwords. I guess I could check each password individually, hope each password is globally unique to me, and then try to match it back to the website where I used it so I can change the password.

If you don’t know which web site uses a particular password, how do you ever login to that website?

Reread the parent post more closely. It does not tell them: A) which site nor B) which password.

The parent can log in because they have a map of sitepassword. But without either the site or the password, the notification that an email address is compromised is useless.

Re: Two billion email addresses were exposed

#413

Post by 6c696e7578 »

8cvor6j844qw_d6 wrote: post #214
naet wrote: post #31

There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even co…

I used per-account email with alias services and password managers. Also started migrating old accounts in free time. Now its pretty easy to tell the source of leak by email addresses as well as sources of spam. --- Per-account alias might sound much, but using sieve filtering [1] is amazing, and you can get a comprehensive filtering solution going with 'envelope to' (the actual address receiving the email) + 'header…

> I used per-account email with alias services and password managers.

20-something-ish years ago I setup qmail in my VPS and a .qmail-default file captures all my me-sitename@vps emails. If they send me junk I echo '#' > .qmail-sitename and that's the end of it.

Other things that get a mixture like someone annoying who harvested my ebay/paypal addresses or something, I'll sift out the good (stuff I need) via maildrop and everything else gets junked.

Honestly one of the best, but annoying, things I've done, well worth the time invested as I have a nice clean mailbox.

Re: Two billion email addresses were exposed

#414

Post by sach1 »

hombre_fatal wrote: post #176
eyeundersand wrote: post #46

Earlier quoted context omitted.

+1 for Bitwarden. It is literally the best solution out there. Been getting to increase uptake in personal circles with (very) limited success. The wife keeps trying to convince me that the ship has sailed in trying to protect info online. She's probably right.

Now that I'm not only using a Macbook and iPhone, I've been looking for cross-platform solutions. For a week I've been using KeePassXC + Syncthing between four devices. Syncthing is also syncing my Obsidian vaults which has replaced Apple-only Notes.app. Bitwarden is definitely more polished, and Syncthing is definitely (much) more fiddly than using Bitwarden's and Obsidian's ($5/mo) native syncing tools. But I like…

I have almost the exact same setup! Hit me up if you have any Qs as I've been a happy user of this for a few years now.

Re: Two billion email addresses were exposed

#415

Post by Stebet »

jiggawatts wrote: post #153
anonu wrote: post #142

> we run on Azure SQL Hyperscale, which we maxed out at 80 cores for almost two weeks the data challenge is interesting here. there's clearly a lot of data - but really its just emails and passwords you need to keep track of. SQL feels like overkill that will be too slow and cost you too much. are there better solutions? 15 billion records of email+password, assume ~40bytes thats roughly 600GB should be searchable wi…

> we run on Azure SQL Hyperscale Definitely the wrong technology, and was almost certainly picked only because Troy Hunt is a "Microsoft Regional Director and MVP". Many other technologies scale better for this kind of workload. Heck, you could ask ChatGPT to write a short C# CLI tool to process the data on one machine, you don't even need a huge box. This kind of thing comes up here regularly on HN for problems such…

Hi.

Stefán (the other HIBP developer) here :)

There are good reasons for the tech we picked. I’ll elaborate in a more detailed answer later today or tomorrow.

I love good nerd discussions.

Re: Two billion email addresses were exposed

#416

Post by EvanAnderson »

mindslight wrote: post #396
EvanAnderson wrote: post #10

Earlier quoted context omitted.

I'm in the same boat. I track all of the unique addresses I use (via my password manager) so I guess I could just check them all against HiBP's database. Kind of a pain in the ass, though.

Me too. It used to work for whole domains. Then I guess the limit was added as part of some kind of monetization push. I don't derive enough value to pay for a monthly subscription any time it occurs to me to check, nor figure out how to check addresses one-by-one programatically. So the site is basically dead to me now. It's a shame because there were a few breached lists where people were speculating on where exact…

I've had that experience re: my personalized addresses being used to more closely identify the source and time of a breach. When I start getting spam to one of my personalized addresses I'll usually reach out to the party for whom the address was created to let them know. Usually I get treated like a crank but occasionally I get somebody who understands and appreciates the help.

Re: Two billion email addresses were exposed

#417

Post by tguvot »

6c696e7578 wrote: post #413
8cvor6j844qw_d6 wrote: post #214

Earlier quoted context omitted.

I used per-account email with alias services and password managers. Also started migrating old accounts in free time. Now its pretty easy to tell the source of leak by email addresses as well as sources of spam. --- Per-account alias might sound much, but using sieve filtering [1] is amazing, and you can get a comprehensive filtering solution going with 'envelope to' (the actual address receiving the email) + 'header…

> I used per-account email with alias services and password managers. 20-something-ish years ago I setup qmail in my VPS and a .qmail-default file captures all my me-sitename@vps emails. If they send me junk I echo '#' > .qmail-sitename and that's the end of it. Other things that get a mixture like someone annoying who harvested my ebay/paypal addresses or something, I'll sift out the good (stuff I need) via maildrop…

did exactly same. the only difference is that i use compromised emails to train spam filter

Re: Two billion email addresses were exposed

#419

Post by hexbin010 »

jbmoney wrote: post #355
hexbin010 wrote: post #303

Earlier quoted context omitted.

1password has better UI/UX and is faster but Bitwarden is cheaper, supports prompting of the master password for specific passwords, and better security options (such as app idle settings instead of just device idle) I just trialled it but got a refund

I started paying for 1Password years ago when an annual family plan was $48, and to their credit, they've kept me grandfathered in to that price this whole time.

I'm not saying 1Password is expensive, but Bitwarden is only $10 a year

Re: Two billion email addresses were exposed

#420

Post by vladvasiliu »

neobrain wrote: post #287
willvarfar wrote: post #283

Earlier quoted context omitted.

I'd be really surprised if Gmail's + behaviour isn't so well known by spammers that they just strip them off?

Conversely, I'd assume this pattern is used rarely enough for spammers to even bother fighting it.

But I've seen service providers who insisted on creating some account with a valid email who wouldn't accept a `+` it in their forms...
Post reply on HN