4 ms·
Maybe you should ask for credit card numbers and passwords to check if they have been compromised.
by asdfaoeu 11y ago
Maybe you should ask for credit card numbers and passwords to check if they have been compromised.
- breakingcups 11y agoTroy Hunt explained somewhere that he doesn't actually store the password (hashes), nor does he want to. See the FAQ as well: https://haveibeenpwned.com/FAQs https://haveibeenpwned.com/FAQs
- natch 11y agoAssurances only go so far. Even if he's a perfectly ethical person, if his service provider is compromised then all bets are off. But, as some replies accurately pointed out, the email addresses are already out there and are not that big a deal anyway.
- 0x62 11y agoThis [0] is an article written by Troy Hunt (the researcher behind HIBP) on the value of email addresses, and answers the question "Can I trust you with my email address?" (in relation to HIBP). [0] http://www.troyhunt.com/2015/11/im-sorry-but-your-email-address-is-not.html http://www.troyhunt.com/2015/11/im-sorry-but-your-email-addr...
- mhurron 11y agoEverything he has in HIBP is taken from public releases. It's already out there, there's not level of 'really out there now.'
- kbenson 11y agoYes, not making the email addresses easily searchable is the worst type of security through obscurity. The type where it's only obscure to you the email address owner, but not to those who would like to exploit you.
- mhurron 11y agoHe's not interested in becoming a search engine for finding exploited accounts.
- kbenson 11y agoI understand, and I believe I was agreeing with you. I was merely noting that while making it searchable takes the difficulty from slightly inconvenient to easy for those who might want to exploit it, it also takes the difficulty from very hard to easy for the average person who may want to defend against it (by determining if they are at risk). I believe that's a net positive.
- manigandham 11y agoWhat do you mean it's not easily searchable? You put your email in and it tells you if it was ever part of a data breach. You can even subscribe for future notices in case it's found in a breach in the future. What more do you need to search for?
- kbenson 11y agoI was replying to the up-thread position[1] summarized as "providing a searchable interface is dangerous because bad actors can use it against you." The context of the thread[1] apparently makes my meaning (that it's okay that it is searchable) somewhat hard to intuit. 1: The thread no longer appears to imply what I thought it was. I don't know whether that's because some comments were edited or because I was just in a state of mind which made me interpret them differently, but I don't think it really matters. My statements were meant to be general for this type of situation, and apply towards the merits of searchable vs non-searchable email addresses, not to assert that this site did one or the other and apply judgement because of that.
- syncsynchalt 11y agohttps://canar.io https://canar.io supports hash lookups for leaked passwords
- afreak 11y agoYup. Coming down the pipeline will be hashing of suspected password lists being posted too. (I am the creator of Canario)
- deadowl 11y agoIs there any way I can guess at my password from the Gawker leak?
- afreak 11y agoI believe that the passwords were exposed in the breach but at the moment I don't have them to look at. Generally I recommend that if you think that your password has been exposed that you just reset your password as if you have to ask that question then you might want to reconsider your password reuse.