6 ms·

Like most of you (probably) I have more than one email address. My host 'hacked' email address has been involved in 6 breaches. Anyone beat that?

andruby 9y ago
Hey PuffinBlue, my email is in 14 breaches :D so yeah, I beat that. (my email is in my profile, you can check) 2 years ago I started using 1password and "user+sitename@domain.com" so I'm no longer worried. I assume all accounts that I haven't migrated are compromised.
- ReverseCold 9y ago
  17 breaches here :)
nukeop 9y ago
A very old email I've used a long time ago has been involved in 7 breaches and 1 paste. None of these passwords have been valid for years though.
akerro 9y ago
No way for me to verify it because I use different username on different sites, and I have a self-hosted catch-all email server, I would have to extract all my usernames or emails from KeePass and check each of them separately... I'm too safe to even know I was hacked.
- PuffinBlue 9y ago
  That might be even more interesting actually. Seeing as you could identify the exact site that was breached. That sort of data would actually be quite valuable to this project I would surmise. I also have a similar system now as you do, but really only for higher value accounts, not the niff naff forums stuff. And like you it's all randomly generated unique passwords so pretty safe. None of my site specific emails have been breached yet, which is good as that would mean a major global provider had been breached.
  - akerro 9y ago
    > That might be even more interesting actually. Seeing as you could identify the exact site that was breached. That sort of data would actually be quite valuable to this project I would surmise. That's why I do it.
  - icebraining 9y ago
    The project seems to know where the data comes from, at least in my case it identified each: Email Pwned sites dropbox@... Dropbox ffshrine@... Final Fantasy Shrine github@... GeekedIn linkedin@... LinkedIn patreon@... Patreon tumblr@... tumblr (The Github one was using their OAuth - which kinda screws with the traceability)
- wrboyce 9y ago
  Unless you're using unique domains, you could use the HIBP domain-wide checker at https://haveibeenpwned.com/DomainSearch https://haveibeenpwned.com/DomainSearch.
  - mstade 9y ago
    I have a setup where I have unique emails for each site I register with, but they are all under a specific domain. I was wondering how I could make use of HIBP and this helps immensely – thank you for sharing!
- jrimbault 9y ago
  I think that's what you want: https://haveibeenpwned.com/DomainSearch https://haveibeenpwned.com/DomainSearch
  - PuffinBlue 9y ago
    I just checked my own domain and there are three addresses pwned that I don't use and never created. I've had the domain for years too. Probably someone just making up an address randomly but three times is a bit odd.
- deleted 9y ago
  [deleted]
christogreeff 9y ago
7 spanning 6 years. What's interesting, is that is the account I use for the more mainstream sites. The accounts I use for sites I don't trust, all has 0.
- E765 9y ago
  Probably just because the more mainstream sites are more 'valuable' targets for breaches.
  - rocqua 9y ago
    This goes not just for hackers, but also for Troy. If some small site gets hacked there is a much smaller chance that it finds its way to Troy.
alexdrans 9y ago
17 and 2
Artemis2 9y ago
16 sites (+2 pastes) with an old email address.
wrboyce 9y ago
Including this breach, I'm up to 13 breaches and 1 paste on my personal email address.
Sevrene 9y ago
I hadn't checked in a long time, I have 13 now. Wow.
ttsda 9y ago
I've got 15 here, but I've used this address for a long time. I've been using unique passwords for a long time too, though.
jacquesm 9y ago
> Anyone beat that? Sure: Zero ;) But that's no real surprise, I try to keep the number of accounts I have to an absolute minimum which is one of the easier ways to avoid this fate.

andruby 9y ago

Hey PuffinBlue, my email is in 14 breaches :D so yeah, I beat that. (my email is in my profile, you can check) 2 years ago I started using 1password and "user+sitename@domain.com" so I'm no longer worried. I assume all accounts that I haven't migrated are compromised.

ReverseCold 9y ago
17 breaches here :)

nukeop 9y ago

A very old email I've used a long time ago has been involved in 7 breaches and 1 paste. None of these passwords have been valid for years though.

akerro 9y ago

No way for me to verify it because I use different username on different sites, and I have a self-hosted catch-all email server, I would have to extract all my usernames or emails from KeePass and check each of them separately... I'm too safe to even know I was hacked.

PuffinBlue 9y ago
That might be even more interesting actually. Seeing as you could identify the exact site that was breached. That sort of data would actually be quite valuable to this project I would surmise. I also have a similar system now as you do, but really only for higher value accounts, not the niff naff forums stuff. And like you it's all randomly generated unique passwords so pretty safe. None of my site specific emails have been breached yet, which is good as that would mean a major global provider had been breached.
- akerro 9y ago
  > That might be even more interesting actually. Seeing as you could identify the exact site that was breached. That sort of data would actually be quite valuable to this project I would surmise. That's why I do it.
- icebraining 9y ago
  The project seems to know where the data comes from, at least in my case it identified each: Email Pwned sites dropbox@... Dropbox ffshrine@... Final Fantasy Shrine github@... GeekedIn linkedin@... LinkedIn patreon@... Patreon tumblr@... tumblr (The Github one was using their OAuth - which kinda screws with the traceability)
wrboyce 9y ago
Unless you're using unique domains, you could use the HIBP domain-wide checker at https://haveibeenpwned.com/DomainSearch https://haveibeenpwned.com/DomainSearch.
- mstade 9y ago
  I have a setup where I have unique emails for each site I register with, but they are all under a specific domain. I was wondering how I could make use of HIBP and this helps immensely – thank you for sharing!
jrimbault 9y ago
I think that's what you want: https://haveibeenpwned.com/DomainSearch https://haveibeenpwned.com/DomainSearch
- PuffinBlue 9y ago
  I just checked my own domain and there are three addresses pwned that I don't use and never created. I've had the domain for years too. Probably someone just making up an address randomly but three times is a bit odd.
deleted 9y ago
[deleted]

christogreeff 9y ago

7 spanning 6 years. What's interesting, is that is the account I use for the more mainstream sites. The accounts I use for sites I don't trust, all has 0.

E765 9y ago
Probably just because the more mainstream sites are more 'valuable' targets for breaches.
- rocqua 9y ago
  This goes not just for hackers, but also for Troy. If some small site gets hacked there is a much smaller chance that it finds its way to Troy.

alexdrans 9y ago

17 and 2

Artemis2 9y ago

16 sites (+2 pastes) with an old email address.

wrboyce 9y ago

Including this breach, I'm up to 13 breaches and 1 paste on my personal email address.

Sevrene 9y ago

I hadn't checked in a long time, I have 13 now. Wow.

ttsda 9y ago

I've got 15 here, but I've used this address for a long time. I've been using unique passwords for a long time too, though.

jacquesm 9y ago

> Anyone beat that? Sure: Zero ;) But that's no real surprise, I try to keep the number of accounts I have to an absolute minimum which is one of the easier ways to avoid this fate.