5 ms·

An old password (12 char numbers and letters) I've since stopped using (but used to use everywhere) appears as pwned in this list (3 times!). I'd love to know w

An old password (12 char numbers and letters) I've since stopped using (but used to use everywhere) appears as pwned in this list (3 times!). I'd love to know who exposed it. Any chance I can find out?

czardoz 9y ago
You could check for your email on https://haveibeenpwned.com/ https://haveibeenpwned.com/
anitil 9y ago
As a policy Troy Hunt won't reveal which breach he found your data in. I considered setting up a series of 'canary' emails so that I could track who's selling what but ... well never got round to it.
- giarc 9y ago
  You used to be able to adjust your email address to check. For example if you email was bill@gmail.com, you could sign up for HN with bill+hackernews@gmail.com. Gmail ignores the part after the + sign. Therefore if you noticed emails coming to that address, you would know that HN sold their list. However, I've found that most forms reject that as a non-valid email address now.
  - outworlder 9y ago
    Yes. Those forms are also ignoring relevant RFCs.
    - deleted 9y ago
      [deleted]
    - emmelaich 9y ago
      Can you be more specific?
      - loeg 9y ago
        Many sites reject valid email addresses. One character it is common for forms to reject is a "+" in the left hand side of an email address. The email RFCs allow this character, so denying it is bogus. Nevertheless, they do. https://tools.ietf.org/html/rfc2822#section-3.4 https://tools.ietf.org/html/rfc2822#section-3.4 atext = ALPHA / DIGIT / ; Any character except controls, "!" / "#" / ; SP, and specials. "$" / "%" / ; Used for atoms "&" / "'" / " * " / "+" / "-" / "/" / "=" / "?" / "^" / "_" / "`" / "{" / "|" / "}" / "~" atom = [CFWS] 1 * atext [CFWS] dot-atom = [CFWS] dot-atom-text [CFWS] dot-atom-text = 1 * atext * ("." 1 * atext) ... addr-spec = local-part "@" domain local-part = dot-atom / quoted-string / obs-local-part
  - deleted 9y ago
    [deleted]
  - kalleboo 9y ago
    I use a catchall address on my own domain name, and use sitename@domain.com to sign up for everything. You should be using your own domain for email anyway
    - tlrobinson 9y ago
      > You should be using your own domain for email anyway Why? I trust Google to secure gmail.com better than I can secure my own domain.
      - Macha 9y ago
        (a) Using your own domain doesn't require using your own mail server, you can point your mx server at Google apps if you're comfortable or your registrar probably supports mail forward if you don't want to pay for G Suite. (B) it means you can keep your email address if you ever leave Gmail.
        tlrobinson 9y ago
        I understand that, but there's still the possibility of the domain name itself being hijacked, or even just forgetting to renew it. Maybe I'm paranoid :)
      - kalleboo 9y ago
        People have had their Google accounts suspended (especially if it's associated to say, a YouTube or AdWords account), and now you have no access to your address anymore, and Googles free tier support won't help you. With domains there's an ICANN process to get your domain back if it gets hijacked.
  - TheSmiddy 9y ago
    I achieve the same thing by just accepting wildcard addresses at my domain and using sitename@mydomain.com whenever I sign up for things.
  - fuzzybeard 9y ago
    Don't any half decent sites strip that out anyways? Some ecommerce sites have actually failed to accept that string, inadvertently thinking it's invalid. The rest, or any marketing CMS, would simply remove it.
    - mulmen 9y ago
      Why would you modify valid user input?
  - fiddlerwoaroof 9y ago
    This is why I configured my dovecot instance to use - instead of + for the mailbox delimeter
- Bromskloss 9y ago
  How does he get hold of the data in the first place?
  - newman8r 9y ago
    not sure what his methods are, but you can find torrents of most of the dumps
  - royce 9y ago
    A combination of public leaks and private contributions. He does a pretty good job of vetting them and determining what era they're from (by polling some users to see when that password was used/changed on that service, etc.)
- royce 9y ago
  While Troy doesn't directly reveal the breaches, it is pretty easy to deduce which public leaks were part of v1 - especially once they're cracked: https://cynosureprime.blogspot.com/2017/08/320-million-hashes-exposed.html https://cynosureprime.blogspot.com/2017/08/320-million-hashe... I anticipate similar results for v2.

czardoz 9y ago

You could check for your email on https://haveibeenpwned.com/ https://haveibeenpwned.com/

anitil 9y ago

As a policy Troy Hunt won't reveal which breach he found your data in. I considered setting up a series of 'canary' emails so that I could track who's selling what but ... well never got round to it.

giarc 9y ago
You used to be able to adjust your email address to check. For example if you email was bill@gmail.com, you could sign up for HN with bill+hackernews@gmail.com. Gmail ignores the part after the + sign. Therefore if you noticed emails coming to that address, you would know that HN sold their list. However, I've found that most forms reject that as a non-valid email address now.
- outworlder 9y ago
  Yes. Those forms are also ignoring relevant RFCs.
  - deleted 9y ago
    [deleted]
  - emmelaich 9y ago
    Can you be more specific?
    - loeg 9y ago
      Many sites reject valid email addresses. One character it is common for forms to reject is a "+" in the left hand side of an email address. The email RFCs allow this character, so denying it is bogus. Nevertheless, they do. https://tools.ietf.org/html/rfc2822#section-3.4 https://tools.ietf.org/html/rfc2822#section-3.4 atext = ALPHA / DIGIT / ; Any character except controls, "!" / "#" / ; SP, and specials. "$" / "%" / ; Used for atoms "&" / "'" / " * " / "+" / "-" / "/" / "=" / "?" / "^" / "_" / "`" / "{" / "|" / "}" / "~" atom = [CFWS] 1 * atext [CFWS] dot-atom = [CFWS] dot-atom-text [CFWS] dot-atom-text = 1 * atext * ("." 1 * atext) ... addr-spec = local-part "@" domain local-part = dot-atom / quoted-string / obs-local-part
- deleted 9y ago
  [deleted]
- kalleboo 9y ago
  I use a catchall address on my own domain name, and use sitename@domain.com to sign up for everything. You should be using your own domain for email anyway
  - tlrobinson 9y ago
    > You should be using your own domain for email anyway Why? I trust Google to secure gmail.com better than I can secure my own domain.
    - Macha 9y ago
      (a) Using your own domain doesn't require using your own mail server, you can point your mx server at Google apps if you're comfortable or your registrar probably supports mail forward if you don't want to pay for G Suite. (B) it means you can keep your email address if you ever leave Gmail.
      - tlrobinson 9y ago
        I understand that, but there's still the possibility of the domain name itself being hijacked, or even just forgetting to renew it. Maybe I'm paranoid :)
    - kalleboo 9y ago
      People have had their Google accounts suspended (especially if it's associated to say, a YouTube or AdWords account), and now you have no access to your address anymore, and Googles free tier support won't help you. With domains there's an ICANN process to get your domain back if it gets hijacked.
- TheSmiddy 9y ago
  I achieve the same thing by just accepting wildcard addresses at my domain and using sitename@mydomain.com whenever I sign up for things.
- fuzzybeard 9y ago
  Don't any half decent sites strip that out anyways? Some ecommerce sites have actually failed to accept that string, inadvertently thinking it's invalid. The rest, or any marketing CMS, would simply remove it.
  - mulmen 9y ago
    Why would you modify valid user input?
- fiddlerwoaroof 9y ago
  This is why I configured my dovecot instance to use - instead of + for the mailbox delimeter
Bromskloss 9y ago
How does he get hold of the data in the first place?
- newman8r 9y ago
  not sure what his methods are, but you can find torrents of most of the dumps
- royce 9y ago
  A combination of public leaks and private contributions. He does a pretty good job of vetting them and determining what era they're from (by polling some users to see when that password was used/changed on that service, etc.)
royce 9y ago
While Troy doesn't directly reveal the breaches, it is pretty easy to deduce which public leaks were part of v1 - especially once they're cracked: https://cynosureprime.blogspot.com/2017/08/320-million-hashes-exposed.html https://cynosureprime.blogspot.com/2017/08/320-million-hashe... I anticipate similar results for v2.