12 ms·
Have I Been Pwned? Data breach master list with API
- asdfaoeu 11y agoMaybe you should ask for credit card numbers and passwords to check if they have been compromised.
- breakingcups 11y agoTroy Hunt explained somewhere that he doesn't actually store the password (hashes), nor does he want to. See the FAQ as well: https://haveibeenpwned.com/FAQs https://haveibeenpwned.com/FAQs
- natch 11y agoAssurances only go so far. Even if he's a perfectly ethical person, if his service provider is compromised then all bets are off. But, as some replies accurately pointed out, the email addresses are already out there and are not that big a deal anyway.
- 0x62 11y agoThis [0] is an article written by Troy Hunt (the researcher behind HIBP) on the value of email addresses, and answers the question "Can I trust you with my email address?" (in relation to HIBP). [0] http://www.troyhunt.com/2015/11/im-sorry-but-your-email-address-is-not.html http://www.troyhunt.com/2015/11/im-sorry-but-your-email-addr...
- mhurron 11y agoEverything he has in HIBP is taken from public releases. It's already out there, there's not level of 'really out there now.'
- kbenson 11y agoYes, not making the email addresses easily searchable is the worst type of security through obscurity. The type where it's only obscure to you the email address owner, but not to those who would like to exploit you.
- mhurron 11y agoHe's not interested in becoming a search engine for finding exploited accounts.
- kbenson 11y agoI understand, and I believe I was agreeing with you. I was merely noting that while making it searchable takes the difficulty from slightly inconvenient to easy for those who might want to exploit it, it also takes the difficulty from very hard to easy for the average person who may want to defend against it (by determining if they are at risk). I believe that's a net positive.
- manigandham 11y agoWhat do you mean it's not easily searchable? You put your email in and it tells you if it was ever part of a data breach. You can even subscribe for future notices in case it's found in a breach in the future. What more do you need to search for?
- kbenson 11y agoI was replying to the up-thread position[1] summarized as "providing a searchable interface is dangerous because bad actors can use it against you." The context of the thread[1] apparently makes my meaning (that it's okay that it is searchable) somewhat hard to intuit. 1: The thread no longer appears to imply what I thought it was. I don't know whether that's because some comments were edited or because I was just in a state of mind which made me interpret them differently, but I don't think it really matters. My statements were meant to be general for this type of situation, and apply towards the merits of searchable vs non-searchable email addresses, not to assert that this site did one or the other and apply judgement because of that.
- syncsynchalt 11y agohttps://canar.io https://canar.io supports hash lookups for leaked passwords
- afreak 11y agoYup. Coming down the pipeline will be hashing of suspected password lists being posted too. (I am the creator of Canario)
- deadowl 11y agoIs there any way I can guess at my password from the Gawker leak?
- afreak 11y agoI believe that the passwords were exposed in the breach but at the moment I don't have them to look at. Generally I recommend that if you think that your password has been exposed that you just reset your password as if you have to ask that question then you might want to reconsider your password reuse.
- zinxq 11y agoWuh oh. All the Mailinator accounts I tried were pwned.
- manigandham 11y agoThis is a great (free) resource run by Troy Hunt, a well-respected Microsoft MVP and security researcher. His blog is full of interesting info: http://www.troyhunt.com/ http://www.troyhunt.com/
- skwirl 11y agoAt the risk of coming across like a shill, I loved his "Hack Yourself First" course on Pluralsight. He does a great job of covering the basics of web security that every web developer should know and he makes it interesting by covering it from the attack angle first. Someday I plan on getting around to subscribing for another month just to go through his newer content.
- michaelbuckbee 11y agoTroy has a good Web Security course up for free at: https://www.varonis.com/learn/web-security-fundamentals/ https://www.varonis.com/learn/web-security-fundamentals/
- Rubus 11y agoOh yeah, it was great! Social Engineering was my favourite bit of it. Top tip: sign up for Visual Studio Dev Essentials (free) with your Microsoft ID, and you might get a free 6 month subscription. I did, but your mileage may vary.
- jongalloway2 11y agoLots of interesting posts in his HIBP series here: http://www.troyhunt.com/search/label/Have%20I%20been%20pwned%3F http://www.troyhunt.com/search/label/Have%20I%20been%20pwned... Covers things like how he's handling privacy (esp regarding the Ashley Madison hack), scaling, Azure deployment, etc.
- jwcrux 11y agoIt's important to note that in addition to the big breaches, this site also collects database dumps from paste sites such as Pastebin. Specifically, I've been feeding logs from my twitter bot, @dumpmon, into HIBP to help build their collection of pastes. Troy is a fantastic researcher and has been awesome to work with!
- mikecb 11y agoI love dumpmon and regularly point it out to colleagues.
- chrisseldo 11y agoRIP foo@bar.com
- emehrkay 11y agoSurprised by how many people use my bs email mark@mark.com (my name is Mark)
- robbyking 11y agoAnd test@example.com.
- raccer 11y agoStill use this in examples xD
- strictnein 11y agoAt least in that case example.com is a reserved domain name http://www.iana.org/domains/reserved http://www.iana.org/domains/reserved
- gk1 11y agoGreat resource. Even more useful for checking family members' email addresses. I use strong passwords, change them frequently, and use 2FA wherever possible... My family (probably) doesn't, nor do they know to check a site like this.
- peterwwillis 11y agoThis would be more useful for non-hacker types if their website's name had "compromised" instead of "pwned" (and really, "pwnd" is the preferred nomenclature)
- gdulli 11y agoAnd less cringey for everyone.
- brazzledazzle 11y agoDoes anyone store fake unique email addresses to see if they've been compromised? I assume you'd need to seed it with new ones occasionally or on some kind of schedule.
- chiph 11y agoLots of people will create a single address for each company that wants one, so that if it gets compromised it can be shut off without affecting any other incoming emails. And identify the offending firm. I have created an email account for a store that wanted an address while I was out in their parking lot (the ones that had plausible future value to me). So far, none have been sold to marketing lists. Which says either that I'm a pretty good judge of firms, or that no one is interested in me. ;)
- colejohnson66 11y agoIf you use gmail, you can insert random periods or append `+word' to your email address and it'll be delivered to the same address as one without periods and the `+word' portion. So, an email to `my.email.address+hackernews@gmail.com' will be delivered to `myemailaddress@gmail.com'.
- james-skemp 11y agoSadly a number of sites get hung up on the '+', despite being valid. One thing to keep in mind if relying upon this.
- jessaustin 11y agoIf they don't know how to email, they probably don't know how to security.
- chiph 11y agoTo be fair, checking that an email address is formatted correctly and valid is a challenge. You can't just use a regex.
- jafingi 11y agoOne of my e-mails was in three breaches: Adobe, Money Bookers, vBulletin, and my Gmail was in only one breach: Boxee forums. I have been receiving a lot of spam lately on my Gmail, and it's not listed anywhere online. So it must have come through a breach somewhere.
- elliottcarlson 11y agoSearching by domain name is great - I use a catch-all on a domain I own and create new accounts for everything I sign up for - being able to see which ones were compromised is pretty nice (and relieving to see only one, on a throw away account).
- Mahn 11y agoGuess that explains why my throw away email was getting a ridiculous amount of spam. Why do people send spam nowadays anyway, is that ever effective? Has a sketchy, poorly worded spam email ever prompted someone to actually buy viagra from them?
- griffinmb 11y agoIf Spam Nation is accurate, spam is actually quite lucrative. The knock-off medications they're peddling often work just as well as the real thing and at a fraction of the cost.
- jessaustin 11y ago...work just as well as the real thing... There are a few ways to take this, but this reminds me most of the diet aids that supposedly consisted of tapeworm eggs.
- brbsix 11y agoKnock-offs, particularly the sort advertised in spam and shitty foreign web shops, often have no active ingredient. Even generics are "knocked off".
- colejohnson66 11y agoBelieve it or not, but a guy came into the grocery store I work at to send a Western Union to a guy in China. He mentioned that his "friend" needed some money to get something out of something and if he helped him, he'd send him some money. The guy bought it and tried to send a few hundred. Lucky for him, the supervisor on WU duty at the time realized it was a scam and told him that his "friend" is lying. After some more persistence on her part, he eventually left.
- STRiDEX 11y agoMine all have emoji in the subject line. which for some reason gmail animates. It's all in the spam folder, but i still check the spam folder from time to time.
- pc86 11y ago
- hellbanner 11y agoThis is uh, a great way to get email addresses.
- STRiDEX 11y agoYou can usually access all the same dumps they use at your favorite shady website. The smaller ones are on pastebin too.
- comboy 11y agoWould be great if I could just provide a hash of my e-mail address.
- Johnny555 11y agoAgreed - I use a lot of email aliases (i.e. myname+merchantname@gmail.com) and I don't really want to upload a list of them to a website to see if any were compromised, I'd feel much better about a hash. Either that or allow a wildcard "myname+*@gmail.com" so I can check them all at once, but that probably has privacy issues of its own.
- peterwwillis 11y agoJust curious, why do you use a different e-mail account for every merchant? All you need is different passwords, and then maybe label filters if you don't want them ending up in your Inbox.
- untog 11y agoThat isn't an account - Gmail sends anything with a +whatever in it to the address without the plus. So, me+mine@gmail.com goes to me@gmail.com. It's useful for exactly the filtering you are describing - and I also use it to track which sites sell my address to spammers (though it's such a simple regex replacement that I'm sure some hide doing so)
- smoyer 11y agoIt's part of the specification ... Anything after the plus sign is considered a comment.
- sp332 11y agoI'm pretty sure that's not true. '+' is allowed in an email address, but it's just a normal character, not a comment. Comments are made with parentheses. https://en.wikipedia.org/wiki/Email_address#Syntax https://en.wikipedia.org/wiki/Email_address#Syntax
- mkane848 11y agoIs there really anything I can do other than update passwords regularly if my email address has been compromised? Apparently I was hit by the Adobe and Bitcoin forum dump. I (think) I create new passwords and change old account passwords often enough and I think literally the only time I've gotten "hacked" was an old XBOX Live account and Origin, and most accounts I care about nowadays also feature 2-Factor Authentication. So while I'd be more pleased if Adobe hadn't leaked my email, I'm not really at risk continuing use of the email address as long as I'm on top of my passwords, right?
- OliverJones 11y agoWhen the Adobe leak hit, I was already using Keepass to generate random passwords for each service I use. So, I changed the password on the Adobe account. I've never had an adverse event based on that leak. Lots of people know your email address. It's your job to make your email address useless, combined with a data breach, to guess a valuable password. If you use passwords like "mysecret-hackernews", "mysecret-github", and "mysecret-paypal" then you're in serious jeopardy if your "mysecret-adobe" gets out. But if you use a bunch of random gibberish for each password, you're relatively safe, at least from that particular attack.
- mkane848 11y agoSorry for the late reply, but thanks for the feedback. While I believe I have a decently strong variety between my passwords, I'm looking at Keepass now and it looks like the exact password manager tool I've wanted for a while now so I'll be giving it a try.
- _RPM 11y agoWhy should I trust this site with my email?
- scholia 11y agohttp://www.troyhunt.com/2015/11/im-sorry-but-your-email-address-is-not.html http://www.troyhunt.com/2015/11/im-sorry-but-your-email-addr...
- blazespin 11y agoDidn't hey use to ask you to verify first before? Great way to snoop on who else has logged on where.
- shostack 11y agoTwo questions as a non-security guy... 1. My two main email addresses were both flagged across the Bitcoin Security Gmail dump, the Gawker Gnosis hit, and then two game DB breaches (D&D Online, Heroes of Newerth). If I've changed my gmail passwords since then with a very strong 1Password PW, is that pretty much all I should be doing at this point? 2. I was never notified by any of these places that my email and password had been compromised. I'm particularly concerned by the two games. Do these companies have any legal obligation to disclose what happened? In the case of D&D Online they have "Dates of birth, Email addresses, IP addresses, Passwords, Usernames, Website activity." So I'm curious what recourse I have. I have to say that the irony in all of this is that my two personal email accounts were both caught up in multiple lists, but none of my family members (who are all considerably less tech-savvy than I am) show up at all.
- schoen 11y ago> is that pretty much all I should be doing at this point? Google also offers two-factor authentication; if you're willing to bear the extra inconvenience, it's one of the biggest possible security wins. https://www.google.com/landing/2step/ https://www.google.com/landing/2step/
- tyre 11y agoTo add to this, it isn't too bad of an inconvenience. You can remember a device for 30 days, so you take an extra 20 seconds 12 times per year.
- mkopinsky 11y agoI complete a Google 2FA much less than once a month. I think the 2FA cookie must live for a month, but my login cookie lasts for much more than that. On a new device, I do of course need the 2FA token.
- putlake 11y agoChanging your Gmail password is not necessarily what you need to worry about because that wasn't compromised. HIBP told you your account at other places e.g. Heroes of Newerth was compromised. So if you used a password for that account that you also used in other places, then you're vulnerable. This is why password re-use is a really bad idea.
- cstrat 11y agotest@test.com Pwned on 48 breached sites and found 650 pastes. Ouch.
- tajen 11y agoOn the other hand, if you own that email you have access to most IT systems of the world. Let me look up your account with my admin@example.com account ;)
- MaulingMonkey 11y agoFinally a service that catches one of the 5+ pwnages I'm aware of!
- original_idea 11y agoThanks Adobe.
- socialjunkie 11y agoAfter reading recent coverage on this guy and his HIBP site, I think it's an absolute disgrace and to be honest I can't seriously be the only one! He gets away with having all these stolen database dumps which is illegal anyway but gets to build a whole site housed around this stolen data and further more benefits from it?! How is this guy any different to one of the people that built an Ashley Madison email search site (ones that didn't display PII) or another search site that allows for the searching through these data dumps? Why is he above the law, the FBI etc have turned a blind eye to what this guy is doing yet will happily see these other site owners prosecuted to the full extent of the law! It's actually quite disgusting that there is one rule for Troy Hunt but another rule for others. The fact of the matter is that in plain simple terms what this guy is doing is actually against the law and illegal. Someone needs to bring a class action lawsuit against this guy and get HIBP shut down! Oh yeah and he claims that haveibeenpwned.org is nothing to do with him as well, I say that is a load of BS!
- sculper 11y agoHow do you think he is violating the law? He's storing email addresses that have already been leaked, and providing a free service for those who are concerned they may have been compromised.