Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The 773M Record “Collection #1” Data Breach

troyhunt.com

Post reply on HN
Print view View original

91–100 of 128 posts

Re: The 773M Record “Collection #1” Data Breach

#91

Post by npongratz »

brennebeck wrote: post #90
sliken wrote: post #46

Earlier quoted context omitted.

Well it claims to take the first 5 characters of the SHA of the plaintext. But it also pulls untrusted code/CSS from various sites over HTTP. It's far from unclear who controls that code. For instance this wall of code: http://az416426.vo.msecnd.net/scripts/a/ai.0.js A more sane approach would be to just put your passwords in a file, maybe by export from your database manager. Take a sha1 of each password, then submi…

Not trying to be a pedant, but wouldn’t “[...]it’s far from clear[...]” be (more?) correct? If it’s ‘far from unclear’, it would seem to imply things are rather clear, IMHO.

I completely agree. Maybe this was the mental model:

    far from unclear           unclear      clear   far from unclear
          ^                                               ^
          |                                               |
          -------------------------------------------------

Re: The 773M Record “Collection #1” Data Breach

#92

Post by martin-adams »

nerdponx wrote: post #84
alexgmcm wrote: post #56

Earlier quoted context omitted.

How does Peekmap work? Their website contains no details. I just can't imagine how you can reliably track a users eye gaze without a webcam - is it just some snake oil pretending to solve everything with AI?

I assume they ran experiments with test subjects navigating websites with both eye and mouse movement tracking, and then trained a model to predict eye tracking from the mouse movement.

Wouldn't they have to train someone using your web site though. So I wonder what happens if you change your site.

I don't know if there is an actual working product though, their Twitter is only 16 hours old.

Re: The 773M Record “Collection #1” Data Breach

#94

Post by nkrisc »

renholder wrote: post #79
markovbot wrote: post #5

Earlier quoted context omitted.

and receive no meaningful legal consequences. These people should be on the hook for all damage done with this dump, but they won't be, so it doesn't really matter. It's not ironic, it's just business as usual. Collecting data on users should be extremely risky, even if they consent to it's collection.

>...and receive no meaningful legal consequences. This, to me, is the most pivotal part. Data was stolen in relation to you? Too bad, so sad. >Collecting data on users should be extremely risky, even if they consent to it's collection. The problem is that it's been so normalised that it's become pedestrian. It's the new norm and no longer risky because "everyone's doing it".

Correct, which is why we need laws and regulations that make it risky by shifting the cost of losing the data to those who collected and lost it in the first place, instead of those whose data were collected.

Re: The 773M Record “Collection #1” Data Breach

#95

Post by romellem »

sliken wrote: post #44
rincebrain wrote: post #41

Earlier quoted context omitted.

You're either not reading the "how this protects your password" link that's on top of the page or claiming it's wrong. [1] It sends the first N characters of the SHA1 hash of the password you provided to the server, the server replies with all the hashes it knows with that prefix, and then the client-side JS compares it to the rest of the hash it has. If you don't believe me, you can look at the request said site iss…

So you are trusting the HTML/CSS and javscript downloaded from troyhunt.com with your plaintext password? Not to mention various bits from cloudflare.com, and other places. There's some code that page uses: http://az416426.vo.msecnd.net/scripts/a/ai.0.js Note the lack of https. You are going to trust a page with that code with your important passwords? Sure it claims to anonymize it first, but most don't know enough…

If you are that distrusting, then do the SHA1 conversion yourself. It isn't that complicated:

  sha1=$(echo -n 'happy123' | tr -d '\n' | openssl sha1)
  result=$(curl https://api.pwnedpasswords.com/range/${sha1:0:5} 
    2>/dev/null | grep $(echo ${sha1:5:35} | tr '[:lower:]' '[:upper:]'))
  echo "Count: ${result#*:}"
With that, I can see that the password 'happy123' has been "pwn'd" 70,617 times.

Re: The 773M Record “Collection #1” Data Breach

#96

Post by russley »

jenscow wrote: post #75
shmageggy wrote: post #21

What's the latest consensus on the best password manager these days. I see he is recommending 1Password, but I recently found Bitwarden which looks quite good.

Now I just recommend to people (who don't understand password managers) to use chrome's built-in feature. It's better than using the same password.

I used to think this, but I think this is actually bad advice for a few reasons.

1. People are bad at making new passwords 2. Someone might clear their browser history and delete the logins as a result. 3. Lock-in into the Chrome ecosystem.

I personally use KeePass, but I understand it is a bit cumbersome to carry around a USB stick.

I'd recommend LastPass to those who don't understand simply because it has a free tier, but everyone else should seriously consider paying the 2$ a month for whichever service they use.

Re: The 773M Record “Collection #1” Data Breach

#97

Post by LaurentS »

ask2sk wrote: post #87
csbartus wrote: post #72

so strange ... i’ve checked again if i was pwned and on the top there is a service i’ve never signed up - Apollo, a sales acceleration platform i’m a simple dev and never subscribed to a sales service ....

I got the same. Anyone here know what is Apollo?

Same here. I had never heard of them. Turns out they're a YC'15 startup (https://www.apollo.io/company/). There are no passwords in the data they lost according to HIBP. They seem to collect personal data from various sources and help other companies increase sales.

Re: The 773M Record “Collection #1” Data Breach

#98

Post by giarc »

cm2187 wrote: post #68
zaroth wrote: post #2

Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached. So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehens…

I took the habit of giving a unique random alias to every website or service who requires my email. The additional benefit is that I can single out where the breach (or spam) came from if I see that unique alias. I only started doing that about 3-4 years ago and so far only the dailymotion breach popped up. You can also do that with gmail by using the login+alias@gmail.com syntax but it's well known and trivial for a…

I've found that a lot of sites will not accept an email with a + in it nowadays.

Re: The 773M Record “Collection #1” Data Breach

#99

Post by hnuser1234 »

hnuser1234 wrote: post #66
hnuser1234 wrote: post #63

Here's one more record to add: my HN password is my username. Feel free to use this account for anonymous well-intentioned posting.

Nice, thanks!

You’re welcome, it may be an interesting social experiment to watch

Re: The 773M Record “Collection #1” Data Breach

#100

Post by giarc »

jenscow wrote: post #75
shmageggy wrote: post #21

What's the latest consensus on the best password manager these days. I see he is recommending 1Password, but I recently found Bitwarden which looks quite good.

Now I just recommend to people (who don't understand password managers) to use chrome's built-in feature. It's better than using the same password.

I tried using Chrome's built in feature but I found the password field was set up wrong on many sites and therefore the "Generate Strong Password" wouldn't be an option. I've since started using BitWarden.
Post reply on HN