Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Two billion email addresses were exposed

troyhunt.com

Post reply on HN
Print view View original

451–460 of 470 posts

Re: Two billion email addresses were exposed

#451

Post by sunnybeetroot »

kevin_thibedeau wrote: post #404
willvarfar wrote: post #283

Earlier quoted context omitted.

I'd be really surprised if Gmail's + behaviour isn't so well known by spammers that they just strip them off?

This is one of the reasons I switched to a different provider using a custom domain. I can make new addresses in any format I want. There's zero risk of a spammer stripping them down to a base address for the primary account. They also don't get rejected by broken validators.

What’s your plan for when you no longer own your custom domain (think bus factor)? Someone else register your domain and now has access to all your accounts.

Re: Two billion email addresses were exposed

#452

Post by Thorrez »

froddd wrote: post #393
Thorrez wrote: post #382

Earlier quoted context omitted.

Only if you want to search by account. If you want to search by password, it's free. You can query all your passwords to see which ones are breached, and change those. > Authorisation is required for all APIs that enable searching HIBP by email address or domain, namely retrieving all breaches for an account, retrieving all pastes for an account, retrieving all breached email addresses for a domain and retrieving all…

The only part of the API that is free is the passwords API, which would not help for this use case. Every other endpoint requires a subscription. This is very far from “The API is free”. > searching by account wouldn't tell you anything useful The API can return the domains listed in stealer logs for a specific email address: https://haveibeenpwned.com/API/v3#StealerLogsForEmail

Sorry, I missed that you were talking about stealer logs. This specific credential dump of 2B emails wasn't a stealer log, so stealer log info will not tell you anything about this specific credential dump.

You're right that the API for stealer log info isn't free.

However, the dashboard can provide you information about stealer logs for free.

https://haveibeenpwned.com/Dashboard#StealerLogs

Re: Two billion email addresses were exposed

#453

Post by ekjhgkejhgk »

the8472 wrote: post #429
Thorrez wrote: post #373

Earlier quoted context omitted.

You can use the API to check all of your passwords. Then you'll know the security state of all of your passwords. https://haveibeenpwned.com/API/v3

Doesn't help. Some accounts are old and may not be in my current PW DB. Or they were memorized, or forgotten. If the thing suggests the EMAIL (+ associated password) has been compromised for some unknown account then to do a risk assessment I would have find which account it belongs to, not which currently-in-use passwords match the same datasets. Those are different queries, providing different bits of information.

Of course it helps.

How's this for making it actionable:

Regardless of whether or not someone can associate it with your email, if your password has been seen in the wild, change it.

There you go.

Re: Two billion email addresses were exposed

#454

Post by mouse-5346 »

sunnybeetroot wrote: post #451
kevin_thibedeau wrote: post #404

Earlier quoted context omitted.

This is one of the reasons I switched to a different provider using a custom domain. I can make new addresses in any format I want. There's zero risk of a spammer stripping them down to a base address for the primary account. They also don't get rejected by broken validators.

What’s your plan for when you no longer own your custom domain (think bus factor)? Someone else register your domain and now has access to all your accounts.

Everyone has their own risk profiles, mine assumes I retain control over my domains and emails. I prepay for them several months in advance to make sure I don't lose ownership. any service provider worth their salt will have a human factor for customer support who can help you if any such issues show up.

Re: Two billion email addresses were exposed

#455

Post by sunnybeetroot »

mouse-5346 wrote: post #454
sunnybeetroot wrote: post #451

Earlier quoted context omitted.

What’s your plan for when you no longer own your custom domain (think bus factor)? Someone else register your domain and now has access to all your accounts.

Everyone has their own risk profiles, mine assumes I retain control over my domains and emails. I prepay for them several months in advance to make sure I don't lose ownership. any service provider worth their salt will have a human factor for customer support who can help you if any such issues show up.

Thank you for expanding. Sure you can prepay up to a certain extent. Eventually your domain will be available to others for purchase and therefore your accounts will become vulnerable. Maybe this isn’t an issue if in the worst situation you’re not around but if this could cause chaos for your friends and family I would suggest taking it into account.

Re: Two billion email addresses were exposed

#456

Post by abustamam »

vladvasiliu wrote: post #443
abustamam wrote: post #422

Earlier quoted context omitted.

I tried to start doing this. The first site I tried to sign up to said it was an invalid email address. I would say they could fuck all the way off, but there are legitimate reasons to not let people sign up with an alias (like one person signing up for multiple free trials)

Right. Because it's oh so difficult to set up a separate e-mail account with one of the free providers. I have such a hard time understanding why people think e-mail addresses are some kind of special thing hard to come by.

When I'm signing up for one service, I don't want to have to sign up for another service, no matter how easy it is. It's not a question of difficulty, it's a question of convenience.

That's why services like Firefox Relay exists. Just generates a new email address for you whose inbox gets relayed to your regular email, no fuss needed. I don't personally pay for it but I do use the heck out of the free email addresses they provided.

Re: Two billion email addresses were exposed

#457

Post by smsm42 »

CaptainNegative wrote: post #221
smsm42 wrote: post #167

Earlier quoted context omitted.

Bitwarden supports TOTP too, even though it's not entirely obvious from the UI.

TOTP inside a password manager doesn't make much sense to me. What's the point of two factor auth if both factors are stored together?

Mostly for the sites that insist on MFA and I need to use daily. Using two separate stores would be too annoying, and the increase in security is minimal - I consider Bitwarden to be secure enough (password + yubikey), and the main scenario somebody could get to my account would be on the server side, or phishing. For that, MFA helps somewhat, but storing MFA code in a separate app doesn't do much.

Re: Two billion email addresses were exposed

#458

Post by smsm42 »

eimrine wrote: post #353
codegrappler wrote: post #341

Earlier quoted context omitted.

2FA most commonly thwarts server-side compromised passwords. An API can leak credentials and an attacker still can’t access the account without the 2FA app, regardless of which app that is. The threat vector it does open you up to are a) a compromised device or b) someone with access to your master password, secret key and email account. Those are both much harder to do and you’re probably screwed in either case unle…

How is it possible to have compromised password but not compromised the second factor? I don't understand the theory of leaking not enough factors. What is stopping webmasters from using 100FA?

> How is it possible to have compromised password but not compromised the second factor?

Server-side (assuming weak password storage or weak in-transit encryption) or phishing (more advanced phishers may get the codes too but only single instance of the code, not the base key).

> What is stopping webmasters from using 100FA?

The users would hunt them down and beat them mercilessly?

Re: Two billion email addresses were exposed

#459

Post by mgpalmer »

Great work by the HIBP team as usual but I am puzzled by something, maybe someone can shed light on it?

I'm managing a domain search dashboard for a company, and for one domain all the recent stealer log breaches contained addresses with the domain - but all the local/user parts were bogus - for example, fabuchoy@example.org where fabuchoy was never a user, the email never existed.

So nothing is in danger but where do these bogus addresses come from? Is someone just trying to log in somewhere with random addresses (with our domain) and then the (failed) login attempt gets sniffed by some malware and ends up in the breach dumps? Or are the cybercriminals just padding their dumps with made-up addresses?

Re: Two billion email addresses were exposed

#460

Post by cestith »

Jaxan wrote: post #362
subscribed wrote: post #354

Earlier quoted context omitted.

Nice. Now I'd like to know WHICH password got leaked. That way the breach impact can quickly be limited. Troy probably would share that information for a price. Not sure whom to pay though - the "good" guy who won't say a word, or a criminal who will happily share it with me? It's possible the latter would be cheaper too.

They don’t store email addresses with password in the database. That would be way too risky. These are separate databases, so you can lookup your email address, and separately check a password.

I think for passwords they only store a hashed version.
Post reply on HN