5 ms·
This information isn't valuable in any way to affected users without an easy way to verify. Obscuring that information doesn't protect the users, it only possi
by binarymelon 9y ago
This information isn't valuable in any way to affected users without an easy way to verify. Obscuring that information doesn't protect the users, it only possibly sends them to places on the web where they are at a higher risk for some other security breach. This is just click bait.
- lsh 9y agoI kind of agree. This Troy Hunt guy is doing a fantastic job with HIBP but this particular release is just so nebulous it's a real time waster.
- kasey_junk 9y agoWhat information are you referring to that is he obscuring?
- dpcx 9y agoFor example, if the names of the files included in the zip file may have been a domain name. From seeing the contents of these dumps before, files are often named in that manner. If they are, then I as the user can then determine where my account was breached. This of course is just one example, and not guaranteed to be an accurate one in this case.
- kasey_junk 9y agoSomething more than the list at the bottom of the post?
- dpcx 9y agoAdblock caught that - apologies.
- rocqua 9y agoWhen an email comes up as compromised in this dump, it would be great if that notification came with the filename(s) in that list where the email was found.
- zokier 9y agoEspecially in this case I think including the filename would have been nice; manually going through list of 2.8k domains and trying to guess if you ever have happened to have an account there is no fun. Having the filename might also help verify the veracity of the information. I suppose the reason for omitting the filename is that Troy does not want to cast any unwarranted trust in the filenames, which is fair.
- rocqua 9y agoMy first guess was that by publishing the file-name, it is easier to link a compromised email to a password. I'd guess that, if you had access to the dumps, this functionality would be about a 10-20x speedup to lookups of the password belonging to an email. However, I think the real reason is privacy. If I recall correctly, there are certain breaches where HIBP redacts the website to protect privacy. A great example of this was ashleymadison. It kinda sucks when anyone that knows your email can learn you were on that site. It seems excessively hard to screen the entire list of 2800 items for such privacy concerns.
- petee 9y agohe publishes the list of domains in this article. I've already recognized one i had an account on, and was able to notify the owner - it looks like it might have been from a known 2016 hack
- raesene9 9y agonot sure why you say that. If you subscribe to HIBP, and your address turns up in one of these breaches, you'll get a notification. you can also search now for your addresses and see if you were affected.
- petee 9y agoSimply knowing is usually good enough for me - nearly anytime my email is identified in a potential breach, I assume it is time to check my accounts and roll my passwords. And just because XYZ site was previously listed as a breach, doesn't mean it wasn't breached again with your new password
- eli 9y agoshouldn't you just periodically check your accounts and rotate passwords? This is obviously not a comprehensive database of every breach.
- petee 9y agoYes, but you gotta find a balance - you'll go crazy if you rotate passwords everyday! Seeing your email in a new breach is certainly a good time to do so.
- Raphmedia 9y agoHaving your address in the list + having your password in https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords is a safe bet.