The 773M Record “Collection #1” Data Breach • Hacker News Board

Re: The 773M Record “Collection #1” Data Breach

#61

Post by hadrien01 » Thu, Jan 17, 2019, 9:55 AM UTC

Angostura wrote: post #59

zaroth wrote: post #2

Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached. So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehens…

Hmmm? He tells you which breach it came from, so in my case I know LinkedIn, Adobe, Dropbox, Binweevils (thanks kids!)

In my case I have an email that was found in Collection #1, but without knowing which site(s). It's an information I'd like to know.

Re: The 773M Record “Collection #1” Data Breach

#62

Post by aequitas » Thu, Jan 17, 2019, 9:57 AM UTC

Got a few 'hacker' emails on one of my throwaway addresses on this list the last few days. That account was leaked before in another list so this was not worrisome as I get those all the time for this address.

What did strike me as odd this time is that they did not end op in my spam folder but in my inbox. I'm using Gmail which normally for me has a very good spam/phishing detection. Somehow these mails came through though? Maybe its just an instance and Google was late to catch up with the cat/mouse game on this attack. Or these phishers are getting more sophisticated?

Re: The 773M Record “Collection #1” Data Breach

#63

Post by hnuser1234 » Thu, Jan 17, 2019, 10:04 AM UTC

Here's one more record to add: my HN password is my username. Feel free to use this account for anonymous well-intentioned posting.

Re: The 773M Record “Collection #1” Data Breach

#64

Post by sjun » Thu, Jan 17, 2019, 10:08 AM UTC

amanzi wrote: post #43

shmageggy wrote: post #21

What's the latest consensus on the best password manager these days. I see he is recommending 1Password, but I recently found Bitwarden which looks quite good.

Bitwarden ( https://bitwarden.com/ ) is great and scores well in feature comparisons -- there was one on here recently. It's open source and has recently been audited too. It's free for the basic service, and really cheap for additional features. Great mobile apps and a web vault. And you can self-host. No bad points really.

The things that held me back from Bitwarden is the relatively short age of the company at 2~ years and the fact that there is only one dev. I'm reaching here. But even though the code is open source, he still owns the distribution. He can potentially be compromised (whether maliciously or not) and release an update that uploads the entire vault to him unencrypted. It could take a while before the internet caught on that the source code doesn't match the release build.

This of course could happen in a company like 1Password and there is at some point that I need to make the call and trust the person(s) coding the password manager. I feel that with 1Password there's at least the large size of the company which would mean more eyeballs and accountability. There is also the history of the company at 12~ years. This includes vetting and buy in from larger companies, which inspires a vote of confidence.

FWIW Bitwarden checks off nearly all the other boxes for me and I think the single dev has done a seriously bang up job.

Re: The 773M Record “Collection #1” Data Breach

#65

Post by thirdsun » Thu, Jan 17, 2019, 10:10 AM UTC

shmageggy wrote: post #21

What's the latest consensus on the best password manager these days. I see he is recommending 1Password, but I recently found Bitwarden which looks quite good.

I'd agree with him: 1Password

- long history - to me it's the original password manager

- frequent updates and always keeping up with relevant OS features, like iOS AutoFill which allows 1Password to be set as the default iOS password store: https://support.1password.com/ios-autofill/

- flawless experience

Re: The 773M Record “Collection #1” Data Breach

#66

Post by hnuser1234 » Thu, Jan 17, 2019, 10:45 AM UTC

hnuser1234 wrote: post #63

Here's one more record to add: my HN password is my username. Feel free to use this account for anonymous well-intentioned posting.

Nice, thanks!

Re: The 773M Record “Collection #1” Data Breach

#67

Post by stevekemp » Thu, Jan 17, 2019, 10:51 AM UTC

I got a notification today that my domain has been included in this collection.

But as far as I can see it is gibberish spam-mails. I see 500+ entries such as:

   fkdsjlfjldsf@example.com
   spamkdsjf31@example.com
   fsdjlfsdjkl@example.com

i.e. None of these emails at my domain are real, nor have they ever been real.

That said if you allow password-based authentication on a server which is shared you might consider using my PAM module:

https://github.com/skx/pam_pwnd

It does lookups of previously-leaked passwords. Best practice these days is SSH-keys for authentication, but this would cover weak sudo passwords too, etc.

Re: The 773M Record “Collection #1” Data Breach

#68

Post by cm2187 » Thu, Jan 17, 2019, 11:03 AM UTC

zaroth wrote: post #2

Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached. So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehens…

I took the habit of giving a unique random alias to every website or service who requires my email. The additional benefit is that I can single out where the breach (or spam) came from if I see that unique alias. I only started doing that about 3-4 years ago and so far only the dailymotion breach popped up.

You can also do that with gmail by using the login+alias@gmail.com syntax but it's well known and trivial for a hacker to defeat.

Re: The 773M Record “Collection #1” Data Breach

#69

Post by eitland » Thu, Jan 17, 2019, 11:04 AM UTC

hnuser1234 wrote: post #63

Here's one more record to add: my HN password is my username. Feel free to use this account for anonymous well-intentioned posting.

Heh, plausible deniability

... but with a non-trivial risk of someone else locking you out from your own account.

Re: The 773M Record “Collection #1” Data Breach

#70

Post by cm2187 » Thu, Jan 17, 2019, 11:07 AM UTC

tfigment wrote: post #12

zaroth wrote: post #2

Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached. So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehens…

Troy's site does indicate which site breach it came from generally. I ran my emails and found it funny when myspace came up (and others I was aware of). I guess I did have an account there after all but I've used password safe for over a decade and always have unique passwords including that one from 2007.

But most of these breaches are just aggregation of passwords he found like in this particular example. It doesn't tell you which website got hacked originally.