4 ms·

I'm not sure how much I can trust the results of a site that claims an email address I only use for one site has been breached on sites and services I've never

I'm not sure how much I can trust the results of a site that claims an email address I only use for one site has been breached on sites and services I've never been to. However it's calculating if what you enter into the form appears in the leaked content sure gives a lot of false positives. Which I suppose forces more awareness, but it doesn't instill a lot of confidence.

wyldfire 10y ago
I think false positives like this are worth reporting upstream. FWIW I was subscribed and didn't get anything until this most recent breach. Unfortunately GMail thought it was spam (speaking of false positives!).
harlanlewis 10y ago
A false positive from your perspective doesn't mean your email address isn't actually being used to sign up for things. My primary personal email address is routinely used by a small handful of other real people (all strangers) for all sorts of things - college applications, car insurance, some address books think it belongs to a cousin who gets included in a lot of group threads about reunions and full of photos. I've found the families more difficult to unsubscribe from than the services, name+email associations spread like a virus. I routinely get alarming/misleading "Someone has your password!" security alerts from Google after someone tries to list my email as a backup account. These little strings we use to identify ourselves can be typed by anyone, anywhere, bot or human. I wouldn't worry too much about false positives.
- thwarted 10y ago
  I wouldn't worry too much about false positives. It's not that I'm worried, it's that it's a distraction. When the margin of error is high enough, it becomes less signal and more noise, which leads to either panic (spending all your time managing access credentials) or complacency (ignoring the indicators).
- manishyt 10y ago
  I have the same problem. Do you have any suggestions on how to handle such emails?
edraferi 10y ago
From https://haveibeenpwned.com/FAQs https://haveibeenpwned.com/FAQs : Why do I see my username as breached on a service I never signed up to? When you search for a username that is not an email address, you may see that name appear against breaches of sites you never signed up to. Usually this is simply due to someone else electing to use the same username as you usually do. Even when your username appears very unique, the simple fact that there are several billion internet users worldwide means there's a strong probability that most usernames have been used by other individuals at one time or another.
snowwrestler 10y ago
Its worth pointing out that other people can use your email address to create accounts. It's just a string of characters to type in. They might not even know it's yours, like if your email is davidsmith@gmail and they fat-finger davidrsmith@gmail--boom, "you" now have an account. Good services use double-opt-in to ensure that every account is actually tied to a correct and working email address. But not every service does this. And even services that do use double opt-in would create a row in their database to note that a confirm email was sent out. If they never scrub those invite rows, "your" email address would still be in the DB when it's exfiltrated, even if the confirmation process was never completed.

wyldfire 10y ago

I think false positives like this are worth reporting upstream. FWIW I was subscribed and didn't get anything until this most recent breach. Unfortunately GMail thought it was spam (speaking of false positives!).

harlanlewis 10y ago

A false positive from your perspective doesn't mean your email address isn't actually being used to sign up for things. My primary personal email address is routinely used by a small handful of other real people (all strangers) for all sorts of things - college applications, car insurance, some address books think it belongs to a cousin who gets included in a lot of group threads about reunions and full of photos. I've found the families more difficult to unsubscribe from than the services, name+email associations spread like a virus. I routinely get alarming/misleading "Someone has your password!" security alerts from Google after someone tries to list my email as a backup account. These little strings we use to identify ourselves can be typed by anyone, anywhere, bot or human. I wouldn't worry too much about false positives.

thwarted 10y ago
I wouldn't worry too much about false positives. It's not that I'm worried, it's that it's a distraction. When the margin of error is high enough, it becomes less signal and more noise, which leads to either panic (spending all your time managing access credentials) or complacency (ignoring the indicators).
manishyt 10y ago
I have the same problem. Do you have any suggestions on how to handle such emails?

edraferi 10y ago

From https://haveibeenpwned.com/FAQs https://haveibeenpwned.com/FAQs : Why do I see my username as breached on a service I never signed up to? When you search for a username that is not an email address, you may see that name appear against breaches of sites you never signed up to. Usually this is simply due to someone else electing to use the same username as you usually do. Even when your username appears very unique, the simple fact that there are several billion internet users worldwide means there's a strong probability that most usernames have been used by other individuals at one time or another.

snowwrestler 10y ago

Its worth pointing out that other people can use your email address to create accounts. It's just a string of characters to type in. They might not even know it's yours, like if your email is davidsmith@gmail and they fat-finger davidrsmith@gmail--boom, "you" now have an account. Good services use double-opt-in to ensure that every account is actually tied to a correct and working email address. But not every service does this. And even services that do use double opt-in would create a row in their database to note that a confirm email was sent out. If they never scrub those invite rows, "your" email address would still be in the DB when it's exfiltrated, even if the confirmation process was never completed.