Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

431–440 of 470 posts

Re: Two billion email addresses were exposed

#431
post #311

Earlier quoted context omitted.

> But the site does not give me any way to take action. It gives you as much information as you should be given. Any more information would just be spreading around the hacked dataset. It does give you an awful lot of information about the specific hacks that exposed your information, and what was the content of that exposure. You may have been owned, but the way you were owned doesn't really matter e.g. I don't care…

Change the password for what account though? The dashboard doesn’t seem to list the actual website(s ) linked to the email/password breached, so how am I to know which password to rotate? If I follow the recommended best practice, I have a different password for every website or service. That could be hundreds of them. Am I supposed to rotate all of them every time there’s a breach?

You buy you email in and then the result it a website that got breached. Together this should give you enough information.

Re: Two billion email addresses were exposed

#432
post #282

I feel like my phone number and email have already been leaked a long time ago. These days I get spam emails almost every day, and random calls from different cities keep coming in. What I keep wondering is how all this data gets out there. Is there an entire underground business built around selling our information?

Yes, unfortunately there is a whole industry out there after your data.

Re: Two billion email addresses were exposed

#433

I was mildly annoyed by the handling of this for domains. I have a personal domain, and now I know that one of the generally service-specific email addresses I've used (most likely with a unique password unless it's Palm levels of old) has been breached with its password. I don't know which one because I don't have a high enough (paid) account. If I'd realized that jumping through the hoops to get onto the site was j…

Domain search is free. I never paid for HIBP and they give me a list of every address @my-domain that’s been leaked. Edit: others are pointing out that it’s only free for domains with fewer than 10 pwned addresses. I have 8.

The message I got wasn't related to the number of addresses affected (though I've been using this approach for a couple decades), but IIRC regarded whether the datasets in question were free.

Re: Two billion email addresses were exposed

#434
post #345
post #314

Earlier quoted context omitted.

With Gmail, also note that firstname.lastname@gmail.com is equivalent to firstnamelastname@gmail.com or fi.rs.tn.am.el.as.tn.am.e@gmail.com As some other comment suggested, these rules are easy to tackle by motivated spammers.

If they were motivated, they wouldn't work as spammers.

10% of all of Meta's income is from scammers.

Re: Two billion email addresses were exposed

#435
post #36

Earlier quoted context omitted.

Addresses? Most of the time addresses are a matter of public record. I have used https://www.fastpeoplesearch.com/ a couple of times to search for people's addresses and it really works. One day a close friend excitedly told me she bought a new house and I told her the address before she told me about it. Telephone number? There used to be phone books. And I still instinctively think they should be public.

> Telephone number? There used to be phone books. And I still instinctively think they should be public. I used to think the same. Around here I feel until a few years ago most people I knew with secret phones were people I would prefer to have fewer interactions with: people who frequently got into trouble, tried to scam others etc. These days I’m more in the camp of layered security. Whatever I can do to make it ha…

They probably block non-U.S. IP addresses since it's for persons in the U.S.

Re: Two billion email addresses were exposed

#436

Earlier quoted context omitted.

You need a domain, and possibly a paid mail provider with catch all support. So cost was always part of this strategy

The problem with catch-all inbox is when you have to reply to an email. Then you have to create the email address to be able to send emails from it. Or are there other solutions?

True, I simplify it a bit based on the capacity of my mail provider. I have like 4 or 5 generic addresses that I give out and use for sending. Sometimes I mix up when sending, but my mail provider (zoho) is pretty decent at keeping track of the addresses anyways.

In a way if I reply, the other party gets upgraded to one of my 5 addresses, so if they send an email to ContosoCoffeeShop@myname.com I might reply from whatever flavour I'm using nowadays or is more appropriate like hello@myname.com

It's like a 3 layer security system, the least privileged get access to one very specific address, if they send me an email which makes sense and I reply, they get upgraded to a bucket. I might sign up directly with a bucket email and skip the most paranoid layer, that's fine.

In general I try to take more care of the newest alias and become more liberal with my older more ruined addresses, alias1@ has like 8 years of signups, while alias5@ has just 1 if any. And I'm sure the list will grow.

Downside is that if there's a leak it's harder to attribute exactly, but at least I can check the recipient to get some kind of hint.

It's more like art than it is a water-tight security protocol. You paint the world with your wacky addresses and occasionally surprise the observant employee with the inverted expectations (usually the name comes before the at)

Thank you for coming to my ted talk.

Re: Two billion email addresses were exposed

#437
post #204

Earlier quoted context omitted.

The number of years I got "free credit monitoring" I can pass it down to my children . . .

I feel like only in the US is credit monitoring something sold as an optional service. I got a confirmation mail from System76, because apparently they feel the need to validate my credit card can’t be used without my approval, but my back does this by default…

Yes. US residents' ability to obtain credit (cards, cars, houses) is based on three shadowy for-profit organizations who each keep a secret score on each resident.

One's employment history is not a factor in the score at all (contrast this with Europe).

Furthermore, privacy in the USA is so bad, the leaking of one's personal details which criminals can use to fraudulently obtain credit and ruin said score and possibly also one's finances is a major concern. Hence, "credit monitoring" exists in order to catch this kind of criminal activity in the act, and I don't know, become completely exasperated with the amount of ass pain that dealing with this then causes.

Re: Two billion email addresses were exposed

#438

This is a massive PITA for any users who exclusively use unique passwords and various unique addresses, as it sounds like the source of the breach(es) is unknown (so hard to judge which accounts would be affected without using Troy's sites to test everything or find some searchable dump online somewhere dubious).

Just check each unique password and then you know which sites need a password change?

That would be hundreds to check. While for the quoted users in the article all but one seems to have reused their password(s), suggesting fewer used overall so easier to check.

Re: Two billion email addresses were exposed

#439

Earlier quoted context omitted.

The sorting is the slowest step by far. Hashing is so fast that you can hand-wave it away as zero cost relative to the time taken to read such a large amount of data. Also, you only have to do it once for the whole input, which means that it's O(n) time where 'n' is the gigabytes of passwords you have. Sorting is going to need about O(n * log n) time even if it's entirely in memory, but more if it has to spool to dis…

What other algorithms have you used? I'm really interested in big data streams. I would like to hear not only successful solutions, but also failed ones. Have you tried using Bloom filters? Is it possible to merge shards using the Min-Heap algorithm?

Algorithm choice depends on what you're optimising for. The discussion a few years ago was dozens of small web servers handling a large volume of password change traffic (10K/sec!) needing a cheap centralised service for verifying against "known bad" passwords. On a cloud hosting platform, the optimal solution is a blob store of sorted binary hashes with a small (~1 MB) precomputed index stored in-memory in the web server that lets you query the main store with 1 or at most 2 reads. This is an optimal "one round trip" request, and the per-server overhead at the front end is negligible.

However, that approach assumes a slowly changing list where you don't mind that there's a delay of maybe a few hours to merge in a new list. Large lists of password leaks are infrequent, so this works fine for this usecase.

A two-layer approach with a small frequently updated hash set on top of the large infrequently built sorted list is more generally applicable to a wider range of problems.

Bloom filters are probabilistic, and aren't much faster to create than a sorted list. They also require 'k' random reads to test, where k is a small constant such as 3 to 5. If the filter is large (gigabytes), then you can't efficiently load it into many front-end web servers. If you query it over the network as a blob, you need 3-5x the I/O operations. You can wrap it in an API service that holds it in-memory, but that's still much more complex than simply storing and querying a blob in S3 or Azure Storage directly.

"Clever" algorithms like min-heaps or whatever are likely not worth the trouble. My decade-old PC can sort 2 billion hashes in about 30 seconds using the Rust "Rayon" crate. There are cloud VMs available for about $2/hr that have about a terabyte of RAM that could sort any reasonable sized list (10s of billions) in a few minutes at most.

The original article mention a week of 80 vCores of SQL Hyperscale, which is about $6,000 at PayG rates!

Sure, developer time is expensive, blah blah blah, but waiting a week ain't cheap either, and these days an AI can bang out the code for a password file hashing and sorting utility in a minute or two.

Re: Two billion email addresses were exposed

#440

Earlier quoted context omitted.

You need a domain, and possibly a paid mail provider with catch all support. So cost was always part of this strategy

I have those things? Did you miss the part where I have multiple vanity URLs and hundreds of email addresses? Of course I have a paid mail provider and catch all. The problem is the cost of haveibeenpwned is too much for me as an individual.

Yeah I get it.

I meant that you are already paying for those, so being charged by providers to support our hacky email addresses is not a novelty introduced by Troy's service

Post reply on HN