7 ms·
I hate to say it, but almost all of these sites/systems end up being far more annoying than useful. Why? Almost all the time, their alerts simply are not action
by octorian 6y ago
I hate to say it, but almost all of these sites/systems end up being far more annoying than useful. Why? Almost all the time, their alerts simply are not actionable. At best, they'll tell you that your username/email was included in a breach and often identify the breach itself by some nebulous data cache name that means nothing to you.
They almost never tell you which site was actually breached, nor do they ever give you any hints as to what password was actually compromised.
So really, when I show up in one of these alerts, I'm always asking myself:
- Was this a recent breach, or a redundant alert from something I dealt with months ago?
- What account do I actually need to update, if any, to be safe from this alert?
These questions almost never seem to be answered. As someone who uses a password manager and a different random password for every site, there's no way I'm going to proactively hunt down and change every single entry in its DB when I get the "alert of the week."
(FWIW, I once worked somewhere that somehow had access to a far better version of this data than they'll ever let the public get access to. That system actually did generate alerts that were actionable. I only wish I had a way to get useful alerts like that as a private individual.)
- newman8r 6y ago> FWIW, I once worked somewhere that somehow had access to a far better version of this data than they'll ever let the public get access to If you really want to hunt it down, a lot of this data is available via torrent, although probably not too useful for generating alerts.
- TimTheTinker 6y ago1Password and other services plug into HIBP to alert you when an account has been pwned and the password should be changed.
- jacoblambda 6y agoIf you use KeepassXC or another password manager of some kind, they are able to tell you which username/password combinations have been compromised.
- jimhefferon 6y agoCan you expand on that for me, please?
- abdullahkhalids 6y agoIf your password is unique for each website because you use a randomly generated one, you can immediately [1] tell by looking at the password which website got compromised. [1] keepassx does not give a way of searching passwords. You can manually look through the list of passwords though.
- darekkay 6y ago> They almost never tell you which site was actually breached That's probably true for most people. But that's what email aliases are for. If I notice (through 1Password alerts) that my me+facebook@mydomain.com email got leaked, I pretty much get an idea which site was breached. At least GMail and Fastmail support email aliasing.
- toyg 6y agoI keep using that scheme but it’s been clear for a while that most systems (and hence leakers) clean up those addresses. Which it has to be expected for a feature that has been around for 15 years.
- clarkdave 6y agoI use `facebook@mydomain.com` instead, which is easy enough to do with catch-all aliases.
- quickthrower2 6y agoOr me+Facebook and block email to me.
- mholt 6y agoThis is the same problem we've had with Certificate Transparency. In grad school we looked at integrating CT monitors into web servers that manage certificates for your sites (including monitoring lookalike or spoofy names), but then weren't sure what to do when a suspicious certificate appeared in the logs. Do you email the site owner? Then what? Sure, you can report to CAs and web hosts and all that, but who will actually go to that trouble? By the time you do that, the site will probably already be blocked by SafeBrowsing and whatever other blocklists.
- blackearl 6y agoI have HIBP alerts setup for client domains and it quickly notifies me, shows me what user emails were in the breach, and a general idea of what data was in the breach (usernames, passwords, financial info). Maybe if you're reviewing old breaches it's pointless, and if you're using a pw manager and taking security seriously you don't need it. But most users will use the same password for work as they do with some stupid app so at least with these alerts I can go and remind them not to use work email to signup for a free hamburger or whatever
- flingo 6y agoA lot of the "breaches" added to the site are from unknown origins. Like, a large mixed collection sold online that somehow found it's way to Troy. Last time I used HIBP, it told me what site the leak was from. If your password shows up at all, you should change it wherever you use it.