4 ms·

I can't remember if it was haveibeenpwned.com or some other site, but I seem to recall once a few years ago checking my email on a site which also showed you th

I can't remember if it was haveibeenpwned.com or some other site, but I seem to recall once a few years ago checking my email on a site which also showed you the first two characters of the password which had been compromised. Maybe it has since been discontinued because of security concerns, but I found it really useful at the time because it let me know that the leaked password was an old one that I hadn't used in years. I know best practice is to immediately change your password regardless, but with the increasing frequency of these kinds of breaches and the reuse and recombination of old lists, how long will it be before emails from leak notification sites like haveibeenpwned start becoming so frequent that people start ignoring them? I am already more guilty of that than I'd like to admit, even though I should know better. I know there are various places you can check a given password against known leak lists, but it makes me really uncomfortable typing my password into anyplace which is not a password manager or the site it's used for - enough that I want to change it afterwards anyway. I already hear the arguments that none of this matters if you follow best practices, which are not wrong, but I've always gone with the option which is as secure as possible without being overly burdensome, and I'm sure I'm not the only one.

TobbenTM 8y ago
I was so sure it was haveibeenpwned.com that showed the password as well, but alas they do not, at least not for the last two years. The way I use to recognize which service has been compromised is using unique email addresses. Most providers let you do either a catchall address, or xyz+alias@provider.com, meaning you should have a user+hn@domain.com for your Hacker News user account. Makes both knowing which services has been hacked easy, but also who sells your contact information to spammers easy! :) Edit: actually, using random passwords from a manager, you should be able to identify it through https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
atnurbel 8y ago
haveibeenpwned has an api to check your password against their known list that only requires to send the first 5 characters of the sha-1 hash: https://api.pwnedpasswords.com/range/5407a https://api.pwnedpasswords.com/range/5407a. You get a list of corresponding hash suffixes and check if yours is there. https://haveibeenpwned.com/api/v2/#SearchingPwnedPasswordsByRange https://haveibeenpwned.com/api/v2/#SearchingPwnedPasswordsBy...
- fwip 8y ago
  That interactive javascript checker on their site also uses that API, so in theory HIBP doesn't get sent a copy of your password. A couple of weeks ago I spun up a little clone with slightly-simpler javascript, just in case HIBP starts serving malicious javascript: https://safepasswordchecker.hashbase.io/ https://safepasswordchecker.hashbase.io/ Feel free to download the site and javascript for a static copy. Or reuse or modify and reshare as you like, as long as you're not malicious. Edit: This site was made with Beaker Browser (https://beakerbrowser.com https://beakerbrowser.com), which is rad, and you should check it out. Feel free to download / fork this site.
- l0b0 8y ago
  I did the offline check yesterday and wrote up how to do it: https://stackoverflow.com/q/54249403/96588 https://stackoverflow.com/q/54249403/96588
hag 8y ago
You CAN check breached passwords here: https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords, if it's a common password it doesn't mean that it's necessarily your account that's been compromised.
foobiekr 8y ago
After the Ashley Madison hack, haveibeenpwned still had not instituted blinding so you could check, for example, if your co-workers or boss has an account there, assuming they were follish enough to use their widely-known personal or employer email addresses (the latter being shockingly common for lifer-types st big companies like HP and Cisco). One of my co-workers ended up getting revealed this way to his then-wife; it wasn’t really a happy marriage up to that point but that was the last straw. Haveibeenpwned has since gated access to the reports which is good....

TobbenTM 8y ago

I was so sure it was haveibeenpwned.com that showed the password as well, but alas they do not, at least not for the last two years. The way I use to recognize which service has been compromised is using unique email addresses. Most providers let you do either a catchall address, or xyz+alias@provider.com, meaning you should have a user+hn@domain.com for your Hacker News user account. Makes both knowing which services has been hacked easy, but also who sells your contact information to spammers easy! :) Edit: actually, using random passwords from a manager, you should be able to identify it through https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords

atnurbel 8y ago

haveibeenpwned has an api to check your password against their known list that only requires to send the first 5 characters of the sha-1 hash: https://api.pwnedpasswords.com/range/5407a https://api.pwnedpasswords.com/range/5407a. You get a list of corresponding hash suffixes and check if yours is there. https://haveibeenpwned.com/api/v2/#SearchingPwnedPasswordsByRange https://haveibeenpwned.com/api/v2/#SearchingPwnedPasswordsBy...

fwip 8y ago
That interactive javascript checker on their site also uses that API, so in theory HIBP doesn't get sent a copy of your password. A couple of weeks ago I spun up a little clone with slightly-simpler javascript, just in case HIBP starts serving malicious javascript: https://safepasswordchecker.hashbase.io/ https://safepasswordchecker.hashbase.io/ Feel free to download the site and javascript for a static copy. Or reuse or modify and reshare as you like, as long as you're not malicious. Edit: This site was made with Beaker Browser (https://beakerbrowser.com https://beakerbrowser.com), which is rad, and you should check it out. Feel free to download / fork this site.
l0b0 8y ago
I did the offline check yesterday and wrote up how to do it: https://stackoverflow.com/q/54249403/96588 https://stackoverflow.com/q/54249403/96588

hag 8y ago

You CAN check breached passwords here: https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords, if it's a common password it doesn't mean that it's necessarily your account that's been compromised.

foobiekr 8y ago

After the Ashley Madison hack, haveibeenpwned still had not instituted blinding so you could check, for example, if your co-workers or boss has an account there, assuming they were follish enough to use their widely-known personal or employer email addresses (the latter being shockingly common for lifer-types st big companies like HP and Cisco). One of my co-workers ended up getting revealed this way to his then-wife; it wasn’t really a happy marriage up to that point but that was the last straw. Haveibeenpwned has since gated access to the reports which is good....