Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I been pwned? Check if your email has been compromised in a data breach

haveibeenpwned.com

Post reply on HN
Print view View original

91–100 of 294 posts

Re: Have I been pwned? Check if your email has been compromised in a data breach

#91

Post by jrockway »

benjamincburns wrote: post #79

I'd like to see a site which validates whether or not your password is exposed. Users should assume that it is exposed, but it would be nice to know wether or not it's floating around in some list somewhere. Problem is, I can't think of a computationally efficient way to perform this check securely. I could see handing the user an nonce, asking them to manually hash their password concatenated with the nonce, and the…

It's possible to write a tool that will figure out all algorithms/salts used by compromised sites, and then hash your password with those algorithms/salts and see if that hash appears in the compromised password files.

Most of the compromised sites use worthless password storage mechanisms, like unsalted hashes or plaintext, so this level of sophistication is mostly unnecessary. For example, say you used the password "foobar".

md5 that:

    $ echo -n "foobar" | md5sum
    3858f62230ac3c915f300c664312c63f  -
Then Google for 3858f62230ac3c915f300c664312c63f. The first result's snippet is:

    = rainbow.lookup('3858f62230ac3c915f300c664312c63f') # => 'foobar' ...
There you go. Don't use "foobar" as your password.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#93

Post by jeremyjh »

Aldo_MX wrote: post #85
cleaver wrote: post #42

I tend to create a new email address for everything I sign up for. This makes a little harder to check :) EG: twitter@example.com, facebook@example.com, hackernews@example.com It also makes it a little harder for people to find me on social media. Not sure if that's a bug or a feature ;)

catchall FTW I follow the following pattern with websites: If the website is important (ex. government), I use @ . My filtering rules are extremely strict, and every mail that doesn't come from the expected website gets automatically flagged as spam and deleted. If their DB leaks, I just change the 4 numbers. If I know the website and it's not an startup, I use @ , ex. facebook@example.com. My filtering rules only fl…

This is brilliant, thanks for sharing.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#95

Post by zenojevski »

elwell wrote: post #88
da_n wrote: post #73

Earlier quoted context omitted.

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

What do you do when you are using a different computer and need to login to site?

Presumably you can open your password manager's web service and do it from there.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#96

Post by baddox »

zenojevski wrote: post #95
elwell wrote: post #88

Earlier quoted context omitted.

What do you do when you are using a different computer and need to login to site?

Presumably you can open your password manager's web service and do it from there.

That or use your phone. Most password managers have apps.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#97

Post by Udo »

Funny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix.

So, let's say for example, my current core is "kgA85kjF3". Then for example, I'd morph that for my Hacker News account to "ZkgA85kjF39!" and my fileserver as "UkgA85kjF3O2". I thought this was a good method of having reasonably long passwords but I'd have to memorize very little per site.

So imagine my surprise, when I created a new password "NkgA85kjF3T3", cracklib found a dictionary word in it. It got worse from there. Through experimentation, I determined that it was indeed the core that was compromised. Any password containing "kgA85kjF3" was compromised.

I have no idea how this happened. If this was not a big cosmic coincidence, if this is not just a random regex filter accident, that means data from at least two known password databases containing my cores has been correlated, and put into cracklib no less. There is really no limit to the imagination regarding what illegitimate databases might contain...

Re: Have I been pwned? Check if your email has been compromised in a data breach

#99

Post by millerm »

cleaver wrote: post #42

I tend to create a new email address for everything I sign up for. This makes a little harder to check :) EG: twitter@example.com, facebook@example.com, hackernews@example.com It also makes it a little harder for people to find me on social media. Not sure if that's a bug or a feature ;)

That's actually a very unadvisable scheme. By doing this you make yourself a target. If any one of those are compromised, attackers will attempt to try that against a lot of popular sites (including banks). If you have your own domain (which I assume you do based on your scheme), I suggest not doing this. You would be better off coming up with a random account name for each and using a password manager to keep track of these.

FYI, I used to do this too. And this is how (in a similar fashion) Mat Honan got Gizmodo's Twitter and his iCloud and Gmail accounts hacked and also had his computer remotely wiped because he used his name in every domain/service as his account name or email account name.

Edited for more information.

Re: Have I been pwned? Check if your email has been compromised in a data breach

#100

Post by Habesha »

elwell wrote: post #88
da_n wrote: post #73

Earlier quoted context omitted.

This should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.

What do you do when you are using a different computer and need to login to site?

You can have the password repository in dropbox to sync between different machines, and also use the app
Post reply on HN