8 ms·

Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users kno

by zaroth 8y ago

Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached. So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehensive, it still leaves users exposed. I know which password of yours was breached, and that information is now effectively public, but you probably don’t know where to find it yourself, and I won’t tell you which one it was. So I guess just assume all your passwords are cracked and use a password manager. I don’t really hold it against Troy, because again, I respect his decision not to store plains directly associated with usernames. He did as much as he was willing to with the data, and it’s better than nothing, but not great all the same.

deleted 8y ago
[deleted]
damontal 8y ago
He has a service that lets you enter a password to check if it’s been pwned though. I guess these are disassociated from user emails?
- sliken 8y ago
  Still seems insane to upload your password.
NoPicklez 8y ago
He has the "Pwned Password" search to allow you to narrow it down and he has a really good article that he links to explaining why despite its inconvenience. If I was him I'd do the same. HIBP is a side project of his and I wouldn't be able to sleep at night knowing I have the responsibility of securing billions of email & password combinations. At the risk of the breach of those accounts adding fuel to the credential stuffing fire and reducing his overall credibility when providing security advice which is his primary occupation. Too risky.
- ehsankia 8y ago
  There wouldn't be any inconvenience if your password manager did its job of helping you manage your passwords. 1Password has implemented a feature that helps you easily check all your passwords, I'm honestly surprised it's taking so long for the others to do too. The data is there, there's a super easy API, it doesn't take that much effort...
  - rerx 8y ago
    Enpass has such a feature too. I just had it check all my passwords in the light of this new breach.
  - deleted 8y ago
    [deleted]
- zawerf 8y ago
  I am not sure you should put too much confidence in the "pwned password" search. I know one of the weak password I stupidly reuse everywhere was compromised since I had someone buy something with my paypal account. But it comes up as clean in the password search. So it was probably cracked from one of the leaked hashes but the plain text was never entered into the public dumps.
  - M2Ys4U 8y ago
    Well one can't prove a negative, that is that your password _hasn't_ been leaked. Knowing that - for sure - a password has appeared in a breach is very useful.
  - 113 8y ago
    It would be impossible for the site to have every password ever compromised. It can only check against a database of known password leaks.
AdmiralAsshat 8y ago
The slightly annoying thing here is that I already use a password manager, so while the impact to me is minimal, I wish I knew which password specifically I have to rotate, instead of assuming that I need to rotate, like, all of them...
- jarfil 8y ago
  What we may need is the next step: a standardized way of changing passwords that would allow us to rotate them in bulk directly from the password manager.
  - Rychard 8y ago
    You might be interested in this, from just over a month ago: https://news.ycombinator.com/item?id=18618193 https://news.ycombinator.com/item?id=18618193
- Groxx 8y ago
  (Not affiliated with, just a happy user of) 1Password does a pretty good job at this, you can find all HIBP-passwords in a single location: https://support.1password.com/watchtower/ https://support.1password.com/watchtower/
- shkkmo 8y ago
  Why not use Pwned Passwords to check your passwords to see if any of them need to be rotated due to this breach or any other?
  - sliken 8y ago
    Seems really weird to advocate people reveal their passwords to a random untrusted 3rd party. They do have an API that allows you to search for your password based on a truncated checksum, so you can find out if your password was leaked, without revealing the password.
    - deleted 8y ago
      [deleted]
tfigment 8y ago
Troy's site does indicate which site breach it came from generally. I ran my emails and found it funny when myspace came up (and others I was aware of). I guess I did have an account there after all but I've used password safe for over a decade and always have unique passwords including that one from 2007.
- cm2187 8y ago
  But most of these breaches are just aggregation of passwords he found like in this particular example. It doesn't tell you which website got hacked originally.
rjf72 8y ago
You can search by password here: https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords If you're as paranoid as you should be about then you can use an API to search using k-anonymity: https://api.pwnedpasswords.com/range/{hashPrefix} https://api.pwnedpasswords.com/range/{hashPrefix} There you can replace "{hashPrefix}" with the first 5 characters of the SHA-1 of your password. It will return a list of all SHA-1's that start with the given 5 character prefix, as well as how many times they've been 'busted'. Ideally it will not return the full SHA of the password you're testing, meaning you're in the clear. For testing purposes, the SHA-1 of "Passw0rd" is "21BD12DC183F740EE76F27B78EB39C8AD972A757". --------- Edit : I previously stated you could search directly by the SHA-1 of your pass alone (in the regular web interface). It looks like this feature has been removed since he's added the k-anonymity feature. So your options are searching directly by password, or using the k-anonymity hash prefix API.
- jancsika 8y ago
  Weird, I don't see any entries for password or password1 in there.
  - umeshunni 8y ago
    I get this when I try 'password': Oh no — pwned! This password has been seen 3,645,804 times before
    - rjf72 8y ago
      I assume he was sending in the SHA-1s. And yeah, it looks like he (Troy Hunt / site operator) disabled the direct search by SHA-1 now that he's enabled the k-anonymity API. Was able to edit and update my original post to reflect this.
- schmich 8y ago
  I wrote a Ruby script to check passwords back when the Pwned Passwords V2 API was introduced. I've added a second script to check a bulk list of passwords in a plain-text file. https://gist.github.com/schmich/aeaffac922271a11b70e9a79a5fee19c https://gist.github.com/schmich/aeaffac922271a11b70e9a79a5fe...
x0x0 8y ago
For me, it was leaked through boltcd, elance, and reseller ratings. All those emails had been regularly leaked. I know because every time I register for a site I use site@mydomain.com as my email.
jethro_tell 8y ago
>So I guess just assume all your passwords are cracked and use a password manager. I mean I do, and that's why I have 100+ passwords that MIGHT be compromised. I don't even know where to start? Seems like the password should be shareable if you control the email or something like that. Fuck, I'd take a cc style last four type redaction or something.
tokyodude 8y ago
I know which passwords were breached by all the emails I get telling me "we know your password is XXXXXXXXX. Pay up or else". There's 4 or 5 in the first 30 messages in my email spam folder. >:(
rbanffy 8y ago
> So I guess just assume all your passwords are cracked and use a password manager. Even if it's not in the HIBP base, you should always assume that. That's why you should always enable MFA everywhere it's possible and consider all services where it's not already compromised.
mpeg 8y ago
You can check the sites involved in the pastebin directory list though.
Angostura 8y ago
Hmmm? He tells you which breach it came from, so in my case I know LinkedIn, Adobe, Dropbox, Binweevils (thanks kids!)
- hadrien01 8y ago
  In my case I have an email that was found in Collection #1, but without knowing which site(s). It's an information I'd like to know.
cm2187 8y ago
I took the habit of giving a unique random alias to every website or service who requires my email. The additional benefit is that I can single out where the breach (or spam) came from if I see that unique alias. I only started doing that about 3-4 years ago and so far only the dailymotion breach popped up. You can also do that with gmail by using the login+alias@gmail.com syntax but it's well known and trivial for a hacker to defeat.
- giarc 8y ago
  I've found that a lot of sites will not accept an email with a + in it nowadays.

by zaroth 8y ago

deleted 8y ago

[deleted]

damontal 8y ago

He has a service that lets you enter a password to check if it’s been pwned though. I guess these are disassociated from user emails?

sliken 8y ago
Still seems insane to upload your password.

NoPicklez 8y ago

He has the "Pwned Password" search to allow you to narrow it down and he has a really good article that he links to explaining why despite its inconvenience. If I was him I'd do the same. HIBP is a side project of his and I wouldn't be able to sleep at night knowing I have the responsibility of securing billions of email & password combinations. At the risk of the breach of those accounts adding fuel to the credential stuffing fire and reducing his overall credibility when providing security advice which is his primary occupation. Too risky.

ehsankia 8y ago
There wouldn't be any inconvenience if your password manager did its job of helping you manage your passwords. 1Password has implemented a feature that helps you easily check all your passwords, I'm honestly surprised it's taking so long for the others to do too. The data is there, there's a super easy API, it doesn't take that much effort...
- rerx 8y ago
  Enpass has such a feature too. I just had it check all my passwords in the light of this new breach.
- deleted 8y ago
  [deleted]
zawerf 8y ago
I am not sure you should put too much confidence in the "pwned password" search. I know one of the weak password I stupidly reuse everywhere was compromised since I had someone buy something with my paypal account. But it comes up as clean in the password search. So it was probably cracked from one of the leaked hashes but the plain text was never entered into the public dumps.
- M2Ys4U 8y ago
  Well one can't prove a negative, that is that your password _hasn't_ been leaked. Knowing that - for sure - a password has appeared in a breach is very useful.
- 113 8y ago
  It would be impossible for the site to have every password ever compromised. It can only check against a database of known password leaks.

AdmiralAsshat 8y ago

The slightly annoying thing here is that I already use a password manager, so while the impact to me is minimal, I wish I knew which password specifically I have to rotate, instead of assuming that I need to rotate, like, all of them...

jarfil 8y ago
What we may need is the next step: a standardized way of changing passwords that would allow us to rotate them in bulk directly from the password manager.
- Rychard 8y ago
  You might be interested in this, from just over a month ago: https://news.ycombinator.com/item?id=18618193 https://news.ycombinator.com/item?id=18618193
Groxx 8y ago
(Not affiliated with, just a happy user of) 1Password does a pretty good job at this, you can find all HIBP-passwords in a single location: https://support.1password.com/watchtower/ https://support.1password.com/watchtower/
shkkmo 8y ago
Why not use Pwned Passwords to check your passwords to see if any of them need to be rotated due to this breach or any other?
- sliken 8y ago
  Seems really weird to advocate people reveal their passwords to a random untrusted 3rd party. They do have an API that allows you to search for your password based on a truncated checksum, so you can find out if your password was leaked, without revealing the password.
  - deleted 8y ago
    [deleted]

tfigment 8y ago

Troy's site does indicate which site breach it came from generally. I ran my emails and found it funny when myspace came up (and others I was aware of). I guess I did have an account there after all but I've used password safe for over a decade and always have unique passwords including that one from 2007.

cm2187 8y ago
But most of these breaches are just aggregation of passwords he found like in this particular example. It doesn't tell you which website got hacked originally.

rjf72 8y ago

You can search by password here: https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords If you're as paranoid as you should be about then you can use an API to search using k-anonymity: https://api.pwnedpasswords.com/range/{hashPrefix} https://api.pwnedpasswords.com/range/{hashPrefix} There you can replace "{hashPrefix}" with the first 5 characters of the SHA-1 of your password. It will return a list of all SHA-1's that start with the given 5 character prefix, as well as how many times they've been 'busted'. Ideally it will not return the full SHA of the password you're testing, meaning you're in the clear. For testing purposes, the SHA-1 of "Passw0rd" is "21BD12DC183F740EE76F27B78EB39C8AD972A757". --------- Edit : I previously stated you could search directly by the SHA-1 of your pass alone (in the regular web interface). It looks like this feature has been removed since he's added the k-anonymity feature. So your options are searching directly by password, or using the k-anonymity hash prefix API.

jancsika 8y ago
Weird, I don't see any entries for password or password1 in there.
- umeshunni 8y ago
  I get this when I try 'password': Oh no — pwned! This password has been seen 3,645,804 times before
  - rjf72 8y ago
    I assume he was sending in the SHA-1s. And yeah, it looks like he (Troy Hunt / site operator) disabled the direct search by SHA-1 now that he's enabled the k-anonymity API. Was able to edit and update my original post to reflect this.
schmich 8y ago
I wrote a Ruby script to check passwords back when the Pwned Passwords V2 API was introduced. I've added a second script to check a bulk list of passwords in a plain-text file. https://gist.github.com/schmich/aeaffac922271a11b70e9a79a5fee19c https://gist.github.com/schmich/aeaffac922271a11b70e9a79a5fe...

x0x0 8y ago

For me, it was leaked through boltcd, elance, and reseller ratings. All those emails had been regularly leaked. I know because every time I register for a site I use site@mydomain.com as my email.

jethro_tell 8y ago

>So I guess just assume all your passwords are cracked and use a password manager. I mean I do, and that's why I have 100+ passwords that MIGHT be compromised. I don't even know where to start? Seems like the password should be shareable if you control the email or something like that. Fuck, I'd take a cc style last four type redaction or something.

tokyodude 8y ago

I know which passwords were breached by all the emails I get telling me "we know your password is XXXXXXXXX. Pay up or else". There's 4 or 5 in the first 30 messages in my email spam folder. >:(

rbanffy 8y ago

> So I guess just assume all your passwords are cracked and use a password manager. Even if it's not in the HIBP base, you should always assume that. That's why you should always enable MFA everywhere it's possible and consider all services where it's not already compromised.

mpeg 8y ago

You can check the sites involved in the pastebin directory list though.

Angostura 8y ago

Hmmm? He tells you which breach it came from, so in my case I know LinkedIn, Adobe, Dropbox, Binweevils (thanks kids!)

hadrien01 8y ago
In my case I have an email that was found in Collection #1, but without knowing which site(s). It's an information I'd like to know.

cm2187 8y ago

I took the habit of giving a unique random alias to every website or service who requires my email. The additional benefit is that I can single out where the breach (or spam) came from if I see that unique alias. I only started doing that about 3-4 years ago and so far only the dailymotion breach popped up. You can also do that with gmail by using the login+alias@gmail.com syntax but it's well known and trivial for a hacker to defeat.

giarc 8y ago
I've found that a lot of sites will not accept an email with a + in it nowadays.