Earlier quoted context omitted.
> But the site does not give me any way to take action. It gives you as much information as you should be given. Any more information would just be spreading around the hacked dataset. It does give you an awful lot of information about the specific hacks that exposed your information, and what was the content of that exposure. You may have been owned, but the way you were owned doesn't really matter e.g. I don't care…
Change the password for what account though? The dashboard doesn’t seem to list the actual website(s ) linked to the email/password breached, so how am I to know which password to rotate? If I follow the recommended best practice, I have a different password for every website or service. That could be hundreds of them. Am I supposed to rotate all of them every time there’s a breach?
Two billion email addresses were exposed
431–440 of 470 posts
Re: Two billion email addresses were exposed
#432I feel like my phone number and email have already been leaked a long time ago. These days I get spam emails almost every day, and random calls from different cities keep coming in. What I keep wondering is how all this data gets out there. Is there an entire underground business built around selling our information?
Re: Two billion email addresses were exposed
#433I was mildly annoyed by the handling of this for domains. I have a personal domain, and now I know that one of the generally service-specific email addresses I've used (most likely with a unique password unless it's Palm levels of old) has been breached with its password. I don't know which one because I don't have a high enough (paid) account. If I'd realized that jumping through the hoops to get onto the site was j…
Domain search is free. I never paid for HIBP and they give me a list of every address @my-domain that’s been leaked. Edit: others are pointing out that it’s only free for domains with fewer than 10 pwned addresses. I have 8.
Re: Two billion email addresses were exposed
#434Earlier quoted context omitted.
With Gmail, also note that firstname.lastname@gmail.com is equivalent to firstnamelastname@gmail.com or fi.rs.tn.am.el.as.tn.am.e@gmail.com As some other comment suggested, these rules are easy to tackle by motivated spammers.
If they were motivated, they wouldn't work as spammers.
Re: Two billion email addresses were exposed
#435Earlier quoted context omitted.
Addresses? Most of the time addresses are a matter of public record. I have used https://www.fastpeoplesearch.com/ a couple of times to search for people's addresses and it really works. One day a close friend excitedly told me she bought a new house and I told her the address before she told me about it. Telephone number? There used to be phone books. And I still instinctively think they should be public.
> Telephone number? There used to be phone books. And I still instinctively think they should be public. I used to think the same. Around here I feel until a few years ago most people I knew with secret phones were people I would prefer to have fewer interactions with: people who frequently got into trouble, tried to scam others etc. These days I’m more in the camp of layered security. Whatever I can do to make it ha…
Re: Two billion email addresses were exposed
#436Earlier quoted context omitted.
You need a domain, and possibly a paid mail provider with catch all support. So cost was always part of this strategy
The problem with catch-all inbox is when you have to reply to an email. Then you have to create the email address to be able to send emails from it. Or are there other solutions?
In a way if I reply, the other party gets upgraded to one of my 5 addresses, so if they send an email to ContosoCoffeeShop@myname.com I might reply from whatever flavour I'm using nowadays or is more appropriate like hello@myname.com
It's like a 3 layer security system, the least privileged get access to one very specific address, if they send me an email which makes sense and I reply, they get upgraded to a bucket. I might sign up directly with a bucket email and skip the most paranoid layer, that's fine.
In general I try to take more care of the newest alias and become more liberal with my older more ruined addresses, alias1@ has like 8 years of signups, while alias5@ has just 1 if any. And I'm sure the list will grow.
Downside is that if there's a leak it's harder to attribute exactly, but at least I can check the recipient to get some kind of hint.
It's more like art than it is a water-tight security protocol. You paint the world with your wacky addresses and occasionally surprise the observant employee with the inverted expectations (usually the name comes before the at)
Thank you for coming to my ted talk.
Re: Two billion email addresses were exposed
#437Earlier quoted context omitted.
The number of years I got "free credit monitoring" I can pass it down to my children . . .
I feel like only in the US is credit monitoring something sold as an optional service. I got a confirmation mail from System76, because apparently they feel the need to validate my credit card can’t be used without my approval, but my back does this by default…
One's employment history is not a factor in the score at all (contrast this with Europe).
Furthermore, privacy in the USA is so bad, the leaking of one's personal details which criminals can use to fraudulently obtain credit and ruin said score and possibly also one's finances is a major concern. Hence, "credit monitoring" exists in order to catch this kind of criminal activity in the act, and I don't know, become completely exasperated with the amount of ass pain that dealing with this then causes.
Re: Two billion email addresses were exposed
#438This is a massive PITA for any users who exclusively use unique passwords and various unique addresses, as it sounds like the source of the breach(es) is unknown (so hard to judge which accounts would be affected without using Troy's sites to test everything or find some searchable dump online somewhere dubious).
Just check each unique password and then you know which sites need a password change?
Re: Two billion email addresses were exposed
#439Earlier quoted context omitted.
The sorting is the slowest step by far. Hashing is so fast that you can hand-wave it away as zero cost relative to the time taken to read such a large amount of data. Also, you only have to do it once for the whole input, which means that it's O(n) time where 'n' is the gigabytes of passwords you have. Sorting is going to need about O(n * log n) time even if it's entirely in memory, but more if it has to spool to dis…
What other algorithms have you used? I'm really interested in big data streams. I would like to hear not only successful solutions, but also failed ones. Have you tried using Bloom filters? Is it possible to merge shards using the Min-Heap algorithm?
However, that approach assumes a slowly changing list where you don't mind that there's a delay of maybe a few hours to merge in a new list. Large lists of password leaks are infrequent, so this works fine for this usecase.
A two-layer approach with a small frequently updated hash set on top of the large infrequently built sorted list is more generally applicable to a wider range of problems.
Bloom filters are probabilistic, and aren't much faster to create than a sorted list. They also require 'k' random reads to test, where k is a small constant such as 3 to 5. If the filter is large (gigabytes), then you can't efficiently load it into many front-end web servers. If you query it over the network as a blob, you need 3-5x the I/O operations. You can wrap it in an API service that holds it in-memory, but that's still much more complex than simply storing and querying a blob in S3 or Azure Storage directly.
"Clever" algorithms like min-heaps or whatever are likely not worth the trouble. My decade-old PC can sort 2 billion hashes in about 30 seconds using the Rust "Rayon" crate. There are cloud VMs available for about $2/hr that have about a terabyte of RAM that could sort any reasonable sized list (10s of billions) in a few minutes at most.
The original article mention a week of 80 vCores of SQL Hyperscale, which is about $6,000 at PayG rates!
Sure, developer time is expensive, blah blah blah, but waiting a week ain't cheap either, and these days an AI can bang out the code for a password file hashing and sorting utility in a minute or two.
Re: Two billion email addresses were exposed
#440Earlier quoted context omitted.
You need a domain, and possibly a paid mail provider with catch all support. So cost was always part of this strategy
I have those things? Did you miss the part where I have multiple vanity URLs and hundreds of email addresses? Of course I have a paid mail provider and catch all. The problem is the cost of haveibeenpwned is too much for me as an individual.
I meant that you are already paying for those, so being charged by providers to support our hacky email addresses is not a novelty introduced by Troy's service