4 ms·

I just learned about this thanks to an email from https://haveibeenpwned.com/ https://haveibeenpwned.com/ alerting me that my account info was leaked.

deleted 9y ago
[deleted]
katastic 9y ago
I just got one about Kickstarter. I've had like 8 this year affect me. Scumbags. If you look at haveibeenpwned's twitter it's like EVERY DAY almost that some major site has a breach. And it's all going on while Congress is too retarded to notice. [edit] Oh, and that "Ding" on my phone was this one too. Lovely. Just lovely. I've literally started switching every infected one, with a custom password generated by SHA-512 fed with /dev/random, and they're 64 characters long except when the POS website refuses to allow that many characters. Even worse, all the "health insurance" and other big-whig companies? Do insane stuff like require "8-16 characters. alphanumeric and capitals only." or even more insane "alphanumeric lower case only." It's impossible in 2017 to actually use modern websites... and be secure. Even if they kept their stuff safe (which they don't), you can't even use a secure password because they won't let you. You're stuck using a couple of actually secure website services like Google and (maybe?) Facebook. But what about the hundreds of other sites you have to interact with every year? Many of which don't support a secure 3rd-party authentication? If my small IT company treated our client's security the way health insurance companies do, we'd be out of business... and possibly in jail. [edit] Who the hell downvotes this? Explain yourself.
marak830 9y ago
Big thank you to Troy Hunt for this service, I just got my email too. I read your comment just after you posted it and thought, "oh I haven't gotten an email yet, I must be safe". . 50 minutes later it came through :-p
cisanti 9y ago
And I learned it from your comment. Just tried haveibeen and confirmed disqus leak. No emails from disqus!
kakkun 9y ago
I got an email too. The thing is, I don't have a Disqus account. The only mention of Disqus in my gmail account is the haveibeenpwned email. Any idea what's going on?
- simoncoggins 9y ago
  Same happened to me. I think I may have used the social media login via Google, which I'm guessing could get your email into the leak without any password being present.
toyg 9y ago
I had three emails from HIBP today, for 3 different breaches: Disqus, Kickstarter and Bitly. Three, in a day. These breaches are all years old and at least one of them was set to one of my old passwords I reused in a lot of places (before moving to a pwd manager), so it could have done some real damage. The fact that it didn't happen, makes me think that salted hashing did what it was supposed to do, discouraging bruteforce decryption just enough. Still, the state of the industry is pretty shocking. We are doing more and more stuff (super-encryption at rest, constant password rotation, password managers etc) and still breaches happen with regularity. It feels a bit like when Office started having a system to recover documents after a crash - yeah, great, but why is the crash happening so often that we need it in the first place?

deleted 9y ago

[deleted]

katastic 9y ago

I just got one about Kickstarter. I've had like 8 this year affect me. Scumbags. If you look at haveibeenpwned's twitter it's like EVERY DAY almost that some major site has a breach. And it's all going on while Congress is too retarded to notice. [edit] Oh, and that "Ding" on my phone was this one too. Lovely. Just lovely. I've literally started switching every infected one, with a custom password generated by SHA-512 fed with /dev/random, and they're 64 characters long except when the POS website refuses to allow that many characters. Even worse, all the "health insurance" and other big-whig companies? Do insane stuff like require "8-16 characters. alphanumeric and capitals only." or even more insane "alphanumeric lower case only." It's impossible in 2017 to actually use modern websites... and be secure. Even if they kept their stuff safe (which they don't), you can't even use a secure password because they won't let you. You're stuck using a couple of actually secure website services like Google and (maybe?) Facebook. But what about the hundreds of other sites you have to interact with every year? Many of which don't support a secure 3rd-party authentication? If my small IT company treated our client's security the way health insurance companies do, we'd be out of business... and possibly in jail. [edit] Who the hell downvotes this? Explain yourself.

marak830 9y ago

Big thank you to Troy Hunt for this service, I just got my email too. I read your comment just after you posted it and thought, "oh I haven't gotten an email yet, I must be safe". . 50 minutes later it came through :-p

cisanti 9y ago

And I learned it from your comment. Just tried haveibeen and confirmed disqus leak. No emails from disqus!

kakkun 9y ago

I got an email too. The thing is, I don't have a Disqus account. The only mention of Disqus in my gmail account is the haveibeenpwned email. Any idea what's going on?

simoncoggins 9y ago
Same happened to me. I think I may have used the social media login via Google, which I'm guessing could get your email into the leak without any password being present.

toyg 9y ago

I had three emails from HIBP today, for 3 different breaches: Disqus, Kickstarter and Bitly. Three, in a day. These breaches are all years old and at least one of them was set to one of my old passwords I reused in a lot of places (before moving to a pwd manager), so it could have done some real damage. The fact that it didn't happen, makes me think that salted hashing did what it was supposed to do, discouraging bruteforce decryption just enough. Still, the state of the industry is pretty shocking. We are doing more and more stuff (super-encryption at rest, constant password rotation, password managers etc) and still breaches happen with regularity. It feels a bit like when Office started having a system to recover documents after a crash - yeah, great, but why is the crash happening so often that we need it in the first place?