6 ms·

An idea for someone looking for a fun "Show HN" project: build a scoreboard that searches all of the known data breaches for this year and tells me where I rank

by mikece 7y ago

An idea for someone looking for a fun "Show HN" project: build a scoreboard that searches all of the known data breaches for this year and tells me where I rank for how many breaches I've been in (eg: I'm 89/132 on breaches of 50,000 records or more). Over 8.5BB customer records were exposed last year; the estimate for this year is in excess of 10BB.

dijit 7y ago
Isn't that what snusbase and dehashed are doing? https://snusbase.com/ https://snusbase.com/ https://www.dehashed.com/ https://www.dehashed.com/
- geddy 7y ago
  These sites really bother me sometimes. I just registered on Dehashed and it requires me to pay for a subscription... to see my own stolen data. I reject that on principle alone.
  - dijit 7y ago
    Mostly so it’s not abused my script kiddies. If you want to see if you are in a breach it will tell you but just censor the password if it has been successfully reversed. Haveibeenpwned is the same but doesn’t reverse the passwords.
    - goatsi 7y ago
      The only difference I can see between them and businesses that have gotten people sent to prison [0] is a slight change in the marketing materials. Dehashed even advertises taking Cryptocurrency payments for "unlimited searches". [0]https://www.zdnet.com/article/company-behind-leakedsource-pleads-guilty-in-canada/ https://www.zdnet.com/article/company-behind-leakedsource-pl...
      - ThrowAway99122 7y ago
        Guy mentioned in the article here using a throwaway (I'm active on this site). Never went to trial, never went to prison, charges were withdrawn. > An investigation by infosec journalist Brian Krebs claimed that a second suspect, a US man named Jeremy Wade, was also behind the service. He was never charged According to American prosecutors, freedom of speech prevents prosecution in America without intent to commit a crime.
        goatsi 7y ago
        I wouldn't bet your freedom on it. The FBI was involved in taking down a similar website just last week [0]. I'm sure they have a solid legal basis for it. [0] https://nationalcrimeagency.gov.uk/news/weleakinfo-com-site-hosting-stolen-credentials-taken-down-after-international-operation https://nationalcrimeagency.gov.uk/news/weleakinfo-com-site-...
        ThrowAway99122 7y ago
        I'm sure they did have a solid basis. The FBI statutes referenced are forfeiture related and don't describe the underlying crime they are accused of, and I'm not familiar with UK or NL law where the accused are located. USA is ironically the only country I would hypothetically bet freedom on to operate such a website not that I need/want to, if it's done without intent to defraud. I'll reply why to a lower comment but the fact that no Americans were able to be charged is a good start.
        lazyasciiart 7y ago
        That doesn't sound accurate. After all, ignorance is no excuse and ignorance of the crime guarantees lack of intent to commit it.
        ThrowAway99122 7y ago
        The most relevant section of US criminal law I'm told is 1030 6a which reads: >(6) knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if— >(A) such trafficking affects interstate or foreign commerce; or >(B) such computer is used by or for the Government of the United States; The key text here is with intent to defraud as an element of the offense. Prosecutors in the USA must prove beyond a reasonable doubt that you had intent to defraud. This language is very clear due to the first amendment and they cannot speculate nor can they say ignorance alone proves intent. Obviously my earlier post of "without intent to commit a crime" was wrong, but should have read "without intent to defraud".
tcd 7y ago
I find it really intriguing hearing about all these data breaches - never before in human history have we been able to store so much information about ourselves and our world and how readily accessible that information is, just sitting on hard disks around the world. Which makes me wonder, is there information that's leaked so much it's no longer "private"? Names, addresses, phone numbers, contacts lists, photos, emails, cloud documents, IP address logs, search history...It's all there, waiting to be leaked... And why the insistence on storing information for an unlimited period of time - it should be illegal to store data above 5+ years without explicit consent from the user (after reviewing the data and clicking "I am okay with this data continuing to be stored").
Barrin92 7y ago
https://monitor.firefox.com/ https://monitor.firefox.com/ this might be something you're looking for.
HenryKissinger 7y ago
https://haveibeenpwned.com/ https://haveibeenpwned.com/
dgrin91 7y ago
You can pretty much do this with haveibeenpwned.
emerongi 7y ago
How about a leaderboard? You get points for each breach that you were in and how much of your data was exposed. Each data point could score different points: your name is 5 points, social security number 10 points etc. Then the you can see that you're 880654th out of 1.1B people on the leaderboard and maybe feel slightly better.. or worse.
kart23 7y ago
How do you know who has been in these breaches? Are websites like haveibeenpwned doing business with hackers to get a hold of emails and websites? And just because one person discovers an open server does that mean that hackers have also discovered and copied all the data? I'm just confused about the actual technical aspects about data breaches.

by mikece 7y ago

dijit 7y ago

Isn't that what snusbase and dehashed are doing? https://snusbase.com/ https://snusbase.com/ https://www.dehashed.com/ https://www.dehashed.com/

geddy 7y ago
These sites really bother me sometimes. I just registered on Dehashed and it requires me to pay for a subscription... to see my own stolen data. I reject that on principle alone.
- dijit 7y ago
  Mostly so it’s not abused my script kiddies. If you want to see if you are in a breach it will tell you but just censor the password if it has been successfully reversed. Haveibeenpwned is the same but doesn’t reverse the passwords.
  - goatsi 7y ago
    The only difference I can see between them and businesses that have gotten people sent to prison [0] is a slight change in the marketing materials. Dehashed even advertises taking Cryptocurrency payments for "unlimited searches". [0]https://www.zdnet.com/article/company-behind-leakedsource-pleads-guilty-in-canada/ https://www.zdnet.com/article/company-behind-leakedsource-pl...
    - ThrowAway99122 7y ago
      Guy mentioned in the article here using a throwaway (I'm active on this site). Never went to trial, never went to prison, charges were withdrawn. > An investigation by infosec journalist Brian Krebs claimed that a second suspect, a US man named Jeremy Wade, was also behind the service. He was never charged According to American prosecutors, freedom of speech prevents prosecution in America without intent to commit a crime.
      - goatsi 7y ago
        I wouldn't bet your freedom on it. The FBI was involved in taking down a similar website just last week [0]. I'm sure they have a solid legal basis for it. [0] https://nationalcrimeagency.gov.uk/news/weleakinfo-com-site-hosting-stolen-credentials-taken-down-after-international-operation https://nationalcrimeagency.gov.uk/news/weleakinfo-com-site-...
        ThrowAway99122 7y ago
        I'm sure they did have a solid basis. The FBI statutes referenced are forfeiture related and don't describe the underlying crime they are accused of, and I'm not familiar with UK or NL law where the accused are located. USA is ironically the only country I would hypothetically bet freedom on to operate such a website not that I need/want to, if it's done without intent to defraud. I'll reply why to a lower comment but the fact that no Americans were able to be charged is a good start.
      - lazyasciiart 7y ago
        That doesn't sound accurate. After all, ignorance is no excuse and ignorance of the crime guarantees lack of intent to commit it.
        ThrowAway99122 7y ago
        The most relevant section of US criminal law I'm told is 1030 6a which reads: >(6) knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information through which a computer may be accessed without authorization, if— >(A) such trafficking affects interstate or foreign commerce; or >(B) such computer is used by or for the Government of the United States; The key text here is with intent to defraud as an element of the offense. Prosecutors in the USA must prove beyond a reasonable doubt that you had intent to defraud. This language is very clear due to the first amendment and they cannot speculate nor can they say ignorance alone proves intent. Obviously my earlier post of "without intent to commit a crime" was wrong, but should have read "without intent to defraud".

tcd 7y ago

I find it really intriguing hearing about all these data breaches - never before in human history have we been able to store so much information about ourselves and our world and how readily accessible that information is, just sitting on hard disks around the world. Which makes me wonder, is there information that's leaked so much it's no longer "private"? Names, addresses, phone numbers, contacts lists, photos, emails, cloud documents, IP address logs, search history...It's all there, waiting to be leaked... And why the insistence on storing information for an unlimited period of time - it should be illegal to store data above 5+ years without explicit consent from the user (after reviewing the data and clicking "I am okay with this data continuing to be stored").

Barrin92 7y ago

https://monitor.firefox.com/ https://monitor.firefox.com/ this might be something you're looking for.

HenryKissinger 7y ago

https://haveibeenpwned.com/ https://haveibeenpwned.com/

dgrin91 7y ago

You can pretty much do this with haveibeenpwned.

emerongi 7y ago

How about a leaderboard? You get points for each breach that you were in and how much of your data was exposed. Each data point could score different points: your name is 5 points, social security number 10 points etc. Then the you can see that you're 880654th out of 1.1B people on the leaderboard and maybe feel slightly better.. or worse.

kart23 7y ago

How do you know who has been in these breaches? Are websites like haveibeenpwned doing business with hackers to get a hold of emails and websites? And just because one person discovers an open server does that mean that hackers have also discovered and copied all the data? I'm just confused about the actual technical aspects about data breaches.