3 ms·

The blog post says that the breach was notified to users, but as some comments here and the post itself are complaining, it doesn't contain any actionable info.

by j1elo 6y ago

The blog post says that the breach was notified to users, but as some comments here and the post itself are complaining, it doesn't contain any actionable info. The official message is that "if you had been doing things right, you don't have to worry". No sh_t Sherlock! But I also worry about my dark past when I was young and ignorant and used weak passwords, before starting to do things "right"... (on the other hand, given the amount of money I paid for HIBP, this is of course just unwarranted entitlement on my side, so I'm just talking half-seriously). I tried to do a trivial grep match on my list of sites, but the regex ended up being a bit long given that hostnames can have lots of variations and it's not so trivial to match them with the format used in the breach. So I've put it all in a Gist in case it is useful for other people: https://gist.github.com/j1elo/50088d6f4587c09fea07b1ccf94ad7b8 https://gist.github.com/j1elo/50088d6f4587c09fea07b1ccf94ad7...

dpcx 6y ago
This was super helpful for me, thanks for it!
maerF0x0 6y ago
HIBP == https://haveibeenpwned.com/ https://haveibeenpwned.com/
tubularhells 6y ago
It does contain actionable info at the end of the article. Last paragraph.
- panarky 6y ago
  "Use strong and unique passwords" is a good practice, but it's not really actionable in response to these breaches. How many normies without password managers remember every site where they created an account in the last five years? Even if they start using strong and unique passwords now, they won't go back and change passwords in services they've forgotten. All I know from Cit0Day is that my account was breached in one or more of 23000+ sites. I can't tell which one(s), so it's not actionable. Troy runs haveibeenpwned as a free public service, so it's not right to ask him to do more than he already has. But to be actionable, each email in the Cit0Day dump could be associated to the individual sites so users would know where they'd been pwned.
- j1elo 6y ago
  Las paragraph says: > Get a password manager, use strong and unique passwords That's more like the overall "mission" of Have I Been Pwned, convince people to do that. It's not a particular actionable suggestion that receivers of the alert email can perform (because, albeit here we're discussing the blog post, actually this has been emailed as a Breach Alert to all HIBP subscribers) To be fair, this promises to be a service that alerts you when your accounts get compromised, and that's 100% what they have done. But in past similar emails, they also contained actionable advise, such as "go to example.com and change your password", which here is missing, so I guess users are left wondering what they can do apart from either ignoring the breach or changing absolutely all their passwords just in case any of them was leaked, or munging on their own the provided TXT listings (which most won't do).

by j1elo 6y ago

dpcx 6y ago

This was super helpful for me, thanks for it!

maerF0x0 6y ago

HIBP == https://haveibeenpwned.com/ https://haveibeenpwned.com/

tubularhells 6y ago

It does contain actionable info at the end of the article. Last paragraph.

panarky 6y ago
"Use strong and unique passwords" is a good practice, but it's not really actionable in response to these breaches. How many normies without password managers remember every site where they created an account in the last five years? Even if they start using strong and unique passwords now, they won't go back and change passwords in services they've forgotten. All I know from Cit0Day is that my account was breached in one or more of 23000+ sites. I can't tell which one(s), so it's not actionable. Troy runs haveibeenpwned as a free public service, so it's not right to ask him to do more than he already has. But to be actionable, each email in the Cit0Day dump could be associated to the individual sites so users would know where they'd been pwned.
j1elo 6y ago
Las paragraph says: > Get a password manager, use strong and unique passwords That's more like the overall "mission" of Have I Been Pwned, convince people to do that. It's not a particular actionable suggestion that receivers of the alert email can perform (because, albeit here we're discussing the blog post, actually this has been emailed as a Breach Alert to all HIBP subscribers) To be fair, this promises to be a service that alerts you when your accounts get compromised, and that's 100% what they have done. But in past similar emails, they also contained actionable advise, such as "go to example.com and change your password", which here is missing, so I guess users are left wondering what they can do apart from either ignoring the breach or changing absolutely all their passwords just in case any of them was leaked, or munging on their own the provided TXT listings (which most won't do).