7 ms·
The Cit0Day Breach Collection
- deleted 6y ago[deleted]
- cm2187 6y agoLooked up my domain, it seems to be old data breaches. I have been using unique email aliases for all websites for at least 5 years and the emails there predate that, and were on previous data breaches.
- wizeman 6y agoWell, you could have registered a long time ago on the breached websites but the breaches could still be very recent, couldn't they? Or are you saying that you registered multiple times on the same website and the leak only contains the old registrations?
- PaulStatezny 6y agoThey are saying that all of the leaked data has been leaked in the past in other breaches. And because every account has a unique address, this suggests that it doesn't contain newly leaked information.
- panarky 6y agoNot true. 65% of email addresses already existed in the haveibeenpwned database, and 35% are new.
- cm2187 6y agoIt could have been breached recently that's true. But not for a website I currently use. I switched off those old emails and I am currently only using aliases (I know it's not very helpful without a list of websites I use). The other thing I do is that I monitor failed smtp connection attempts to my mail server, particularly when they use one of these unique email aliases. That gives me advanced notice that the website has been breached, and I have quite a few that are not on HIBP's radar.
- toast0 6y agoIt's not just old breaches. I do similar things, and got anew address reported. Unfortunately, the new address is one I actually use for a bunch of things, so now I have to go through the site lists. Edit: I looked through email at the services I signed up for with this address, and searched though the list; I'm fairly sure it's the account for a local game club :(
- blackboxlogic 6y agoI wish the notification email included the file name(s) my email was found in. Otherwise, it's not actionable.
- fazer 6y agoSame here, can I download the whole database somewhere and search for my mail address?
- jtbayly 6y agoI don't know why this was flagged. Sure, somebody could be asking about doing this because they want everybody else's data. On the other hand, that's why Troy Hunt did it, so that doesn't seem to be a problem in and of itself. Plus, the most obvious reason to ask this question is the actual reason stated. I'd like to be able to do that, too, frankly. I'll answer the question, though: Not unless you know how to find it.
- ZoomZoomZoom 6y agoThere's no way to know which site the e-mail was coming from, but you could at least grep[2] your password database (depends on how diligent you are with entering urls), and check the top leaked sites manually[1]. Note, that the first list published by Troy is truncated, so it's not full. 1: cat gist1.txt gist2.txt | awk '{print $1, gensub(/[{}.]*/,"","g",$2)}' | sort -rnk2 > cit0-urls-sorted.txt 2: cat gist1.txt gist2.txt | awk '{print $1}' | sort -u > cit0-urls.txt grep -Fif cit0-urls.txt DATABASE.csv
- peteri 6y agoI was planning on an automated check on my passwords via my password manager to see which one have been stolen. Since my passwords are mostly (I may have missed changing some after the linkedin breach) unique these days I thought I could probably figure out which one was stolen as a result.
- scoot 6y ago> the first list published by Troy is truncated Where is that list? I couldn't see it linked from the article. (Sorry if I just missed it)
- ZoomZoomZoom 6y agoThey are at the start of the article. He said he fixed the truncated one down in the comments, but I don't see it being fixed. https://gist.githubusercontent.com/troyhunt/0282a5bad48bd6698672735519ca883a/raw/53ba9bd51256dc658b39094660ac3c2ade7f3aea/Cit0day%20%5B_special_for_xss.is%5D.txt https://gist.githubusercontent.com/troyhunt/0282a5bad48bd669... https://gist.githubusercontent.com/troyhunt/54d421427ae0c32cadc7e18aac28b539/raw/4a12218baf062730eedbbeb8c21b5ef97b5ab86c/Cit0day%20Prem%20%5B_special_for_xss.is%5D.txt https://gist.githubusercontent.com/troyhunt/54d421427ae0c32c...
- aSockPuppeteer 6y agoI couldn't grep any sites from my list but was on the email list. I guess it's just a reminder to not use easy passwords and to change them often. Had to make an icloud keychain password copy script for someone so that was something new.
- j1elo 6y agoThe blog post says that the breach was notified to users, but as some comments here and the post itself are complaining, it doesn't contain any actionable info. The official message is that "if you had been doing things right, you don't have to worry". No sh_t Sherlock! But I also worry about my dark past when I was young and ignorant and used weak passwords, before starting to do things "right"... (on the other hand, given the amount of money I paid for HIBP, this is of course just unwarranted entitlement on my side, so I'm just talking half-seriously). I tried to do a trivial grep match on my list of sites, but the regex ended up being a bit long given that hostnames can have lots of variations and it's not so trivial to match them with the format used in the breach. So I've put it all in a Gist in case it is useful for other people: https://gist.github.com/j1elo/50088d6f4587c09fea07b1ccf94ad7b8 https://gist.github.com/j1elo/50088d6f4587c09fea07b1ccf94ad7...
- dpcx 6y agoThis was super helpful for me, thanks for it!
- maerF0x0 6y agoHIBP == https://haveibeenpwned.com/ https://haveibeenpwned.com/
- tubularhells 6y agoIt does contain actionable info at the end of the article. Last paragraph.
- panarky 6y ago"Use strong and unique passwords" is a good practice, but it's not really actionable in response to these breaches. How many normies without password managers remember every site where they created an account in the last five years? Even if they start using strong and unique passwords now, they won't go back and change passwords in services they've forgotten. All I know from Cit0Day is that my account was breached in one or more of 23000+ sites. I can't tell which one(s), so it's not actionable. Troy runs haveibeenpwned as a free public service, so it's not right to ask him to do more than he already has. But to be actionable, each email in the Cit0Day dump could be associated to the individual sites so users would know where they'd been pwned.
- mikece 6y agoI've read in multiple sources that security researchers hate HaveIBeenPwned because someone can repackage previous breach data, send it to Troy, and he will announce to the world "OMG, there's a new data breach and your address is in it!" While Troy is into security, he freely admits he launched HIBP as an exercise to do something in Azure and see how little it would cost to run analysis on large data sets. As such, if Troy's service is the source of a "new data breach" I generally disregard it and wait to see if the other sources concur or dismiss it as a repacking attempt by some wannabe hacker trying to make a name.
- jtbayly 6y agoOr you could read the post where he analyzes what percent of the data isn't yet in his database and determines there is plenty of new data.
- vmception 6y agoOkay, so why do security reseachers hate that? because it advertises the hacker's services and monetizes that hacker without that hacker actually having to go through the trouble of weaponizing the data themselves for monetization? because it advertises the breach for sale on a dark net marketplace as people instinctively go look for it? except for people indoctrinated to believe dark net is "scary" instead of just like Amazon because they never looked. some other reason?
- fpgaminer 6y agoI use unique email addresses for every website, so I can confirm that this breach includes a new leak from an address created on October 2019. In my case it was just from a guest order at some random restaurant; nothing critical. Oddly, I didn't see the website in the list of files in the leak. So the file list might not be "complete", in the sense that grepping it won't be 100% accurate. Just FYI. EDIT: As always, thank you Troy for running HIBP. You're a hero.
- ed25519FUUU 6y agoHow do you know which site needs a password reset? I'm in the same boat, but apart from downloading this entire leak somehow, I don't know which site I need to reset.
- scoot 6y agoFrom the unique email address breached, for example example.com@mysubdomain.com. Curiously the breach included my direct personal email address that I have only used for a handful of sites in the last 10 years.
- sixstringtheory 6y agoTangential, but something I think about every time breaches or password managers come up is this: what if every time I log into a service, i do it through password reset? that way I never have to even store the passwords, and it changes with the frequency of use. The more I use a given service, the less likely I am to be impacted by a password dataset being released. Basically the magic link that Slack uses, but with a few extra steps. What would be some security pros and cons of this approach? And ultimately, [how] can e-mail be removed as the single point of failure?
- remram 6y agoA few services do that, for example Liberapay [1]. It's also not much different from how other social sign-in methods work (Facebook, Google, GitHub), only you already have your email on file. I guess the main drawback is the email delivery delay, which is much slower than an HTTP workflow. [1]: https://liberapay.com/sign-in https://liberapay.com/sign-in
- ed25519FUUU 6y agoApart from downloading the breach and parsing it myself, where can I actually see the password used for my email? I obviously control that email, so there shouldn't be any harm in getting the password delivered there. I want to know if the password used was fake or real.
- Atemu12 6y agoYou could put your real password through HIBP's password checker as they should have the passwords harvested from this breach in their database.