Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We are discontinuing the dark web report

support.google.com

Post reply on HN
Print view View original

51–60 of 61 posts

Re: We are discontinuing the dark web report

#51

Post by godelski »

deepsun wrote: post #37
placatedmayhem wrote: post #34

Earlier quoted context omitted.

Or, use a service that lets you generate an address for each business you deal with or use case you have so you can treat them as disposable. After chasing down spammers and companies selling my info, including my email, I found this was easier to keep up with and is more effective. Spam me once or sell it to another company, and I burn that address, replacing it with the original company if I really need them to kee…

I tried to do that but found out there's almost no services that I would want to treat my account there disposable. If I bother to provide them my email address -- I usually also want to access my account there later (e.g check order status). There are tens of services where I'd like it disposable, but hundreds of services where account is warranted. And some of those thousands will be compromised some day.

You can do this with aliases. For example Firefox's relay (or you can do it with a website and cloudflare). They'll also give you a catchall domain so you can either have generated emails like "adafergtrees@mozmail.com" or "NameOfArbitraryBusiness@deepsun.mozmail.com". If you want to trash an email you can do that too.

Re: We are discontinuing the dark web report

#52

Post by sharperguy »

godelski wrote: post #50
eXpl0it3r wrote: post #49

Earlier quoted context omitted.

That's already what is happening... When you do a check on https://haveibeenpwned.com/Passwords nothing is sent to the server. Instead the password is hashed locally and a list of the hash range is downloaded, which contains all the hashes and the number of occurrences. The server doesn't receive the password, neither in plain-text nor hash form.

They meant you submit the checksum instead of your password. Replace "Password to check" with "Checksum to check"

It would be easy enough to add this as a "secret" feature:

* user submits password * gets hashed client side * server compares it against stored hashes * server also re-hashes the stored hash, and compares it against the hash received from the client

This would effectively mean that either entering the password, or the password hash would correctly match, since when entering the hash you are effectively "double" hashing the password which gets compared to the double hashed password on the server.

The upside is that users who don't understand hashing or don't feel like opening a sha256 tool wouldn't have to change their behavior or even be confused by a dialog explaining why they should hash the input, while advanced users could find out about the feature via another channel (e.g. hackernews).

The downside would be that it adds an extra hash step to every comparison on the sever. It's hard to know how expensive this would be for them.

Re: We are discontinuing the dark web report

#53

Post by account42 »

eXpl0it3r wrote: post #49
clarionbell wrote: post #47

Earlier quoted context omitted.

I always thought that it could be reasonably simple to have a safe alternative. Have people enter a SHA256 of their password instead, and match against a database of other hashes. Almost everyone interested in checking for password leaks knows how to generate SHA256 of a string. And those who don't shouldn't put their passwords on the internet. Or even better, generate hash for all passwords in the database, package…

That's already what is happening... When you do a check on https://haveibeenpwned.com/Passwords nothing is sent to the server. Instead the password is hashed locally and a list of the hash range is downloaded, which contains all the hashes and the number of occurrences. The server doesn't receive the password, neither in plain-text nor hash form.

Care to explain how you can tell what scripts gp was sent for the page https://haveibeenpwned.com/Passwords and what scripts he will be sent on future visits?

Re: We are discontinuing the dark web report

#54

Post by thesuitonym »

deepsun wrote: post #31
thesuitonym wrote: post #20

Earlier quoted context omitted.

I never got the Google dark web reports, but my credit card used to send me reports constantly saying that my email address was 'found on the darkweb.' Okay, that's not useful information. If it showed me if there were associated passwords, that might be helpful, but just saying my address was found on the darkweb is meaningless. My email address is public information. The worst part is, it was an email address I had…

Well you could change the email address you use for the financial services only, and keep it secret. Then it would be harder to impersonate you.

Well, I could, and actually did. Like I said, I couldn't get that email address out of the report.

Re: We are discontinuing the dark web report

#55

Post by IAmBroom »

culi wrote: post #46
nomilk wrote: post #44

Earlier quoted context omitted.

> I found (it) not actionable Tangental, but I found 'Have I Been Pwned' useless too because you can't enter your email and find leaked passwords associated with the address, instead you have to enter each password (and repeat for every password you want to check). I know there's an explanation that the raw password is not being sent and instead being hashed locally and only part of the hash is sent. But I don't know…

Well of course a hostile actor could use this incredibly accessible resource to test a bunch of emails and find their passwords. Though perhaps there could be a service where you enter in an email address and it sends an email to that address containing the passwords. That would be a slightly more complicated server to set up though

OK, I would pay for this service.

It doesn't use any information that's not already exposed.

It reveals the extent of my problem to me.

Re: We are discontinuing the dark web report

#56

Post by dpoloncsak »

culi wrote: post #46
nomilk wrote: post #44

Earlier quoted context omitted.

> I found (it) not actionable Tangental, but I found 'Have I Been Pwned' useless too because you can't enter your email and find leaked passwords associated with the address, instead you have to enter each password (and repeat for every password you want to check). I know there's an explanation that the raw password is not being sent and instead being hashed locally and only part of the hash is sent. But I don't know…

Well of course a hostile actor could use this incredibly accessible resource to test a bunch of emails and find their passwords. Though perhaps there could be a service where you enter in an email address and it sends an email to that address containing the passwords. That would be a slightly more complicated server to set up though

Im 99% sure this is exactly what HIBY used to do, and changed their processes. I'm unsure if this was due to government pressures or what

Re: We are discontinuing the dark web report

#58

Post by nix0n »

nomilk wrote: post #44
prepend wrote: post #11

I found the info not actionable because it wouldn’t say what actual values were posted. I have a common name Gmail account. The password is rather complex and I would be surprised if it leaks as only I and Google know it. However, I would get reports that it’s on the dark web with blanked out password values. So I never knew if they actually compromised or just something else. They would also report when some random…

> I found (it) not actionable Tangental, but I found 'Have I Been Pwned' useless too because you can't enter your email and find leaked passwords associated with the address, instead you have to enter each password (and repeat for every password you want to check). I know there's an explanation that the raw password is not being sent and instead being hashed locally and only part of the hash is sent. But I don't know…

There's an API[0] that takes a prefix of a hash.

I don't know how to verify what the website does, but I think that in a few minutes I'll be able to put together a CURL call that does what we're hoping the website does.

[0]https://haveibeenpwned.com/API/v3#PwnedPasswords

Re: We are discontinuing the dark web report

#59

Post by prajaybasu »

nomilk wrote: post #44
prepend wrote: post #11

I found the info not actionable because it wouldn’t say what actual values were posted. I have a common name Gmail account. The password is rather complex and I would be surprised if it leaks as only I and Google know it. However, I would get reports that it’s on the dark web with blanked out password values. So I never knew if they actually compromised or just something else. They would also report when some random…

> I found (it) not actionable Tangental, but I found 'Have I Been Pwned' useless too because you can't enter your email and find leaked passwords associated with the address, instead you have to enter each password (and repeat for every password you want to check). I know there's an explanation that the raw password is not being sent and instead being hashed locally and only part of the hash is sent. But I don't know…

Bitwarden's web vaults has a reports feature which allows you to check this in bulk.

Re: We are discontinuing the dark web report

#60

Post by yencabulator »

nomilk wrote: post #44
prepend wrote: post #11

I found the info not actionable because it wouldn’t say what actual values were posted. I have a common name Gmail account. The password is rather complex and I would be surprised if it leaks as only I and Google know it. However, I would get reports that it’s on the dark web with blanked out password values. So I never knew if they actually compromised or just something else. They would also report when some random…

> I found (it) not actionable Tangental, but I found 'Have I Been Pwned' useless too because you can't enter your email and find leaked passwords associated with the address, instead you have to enter each password (and repeat for every password you want to check). I know there's an explanation that the raw password is not being sent and instead being hashed locally and only part of the hash is sent. But I don't know…

> (if anyone knows how to verify HIBP does only what it says it does [rather than blindly trust and hope for the best], would love to read more about it)

I recall HIBP documents their hashing protocol so that it should be possible to have a non-web client you can trust more.

https://haveibeenpwned.com/API/v3#PwnedPasswords

Post reply on HN