12 ms·
A decade of Have I Been Pwned
- user_7832 3y ago> Not to mention all the other weird variations including haveibeenburned.com, haveigotpwned.com, haveibeenrekt.com and after someone made the suggestion following the revelation that PornHub follows me, haveibeenfucked.com That is honestly pretty hilarious of a side effect of media fame!
- thierrydamiba 3y ago[dead]
- gumby 3y ago> haveibeenfucked.com Years ago we had friends, a couple in which the wife was pregnant. They were actually a bit embarrassed that “everyone will know that we ‘did it’”. A level of squeamishishness I could not have imagined!
- lainga 3y agoHaha, yes, for the same reason it used to be rude to ask "when are you expecting?", especially if newly married
- onionisafruit 3y agoThat reminds me of my early twenties being embarrassed when my wife told her parents we are trying to get pregnant.
- gumby 3y agoWhen people would ask us, “when will you have a second baby?” we started to answer, “oh, we figured out what causes it!” which usually shut down that line of questioning.
- koolba 3y ago> They were actually a bit embarrassed that “everyone will know that we ‘did it’”. Most people would be more embarrassed if the wife is clearly pregnant and nobody thinks they “did it”.
- yesbabyyes 3y agoI remember reading about something like that in a book, think they were called Mary & Joseph.
- deleted 3y ago[deleted]
- saagarjha 3y agoThe alternative sounds worse, no?
- m3047 3y agoI've always loved pornhub's blog: https://www.pornhub.com/insights/ https://www.pornhub.com/insights/
- Cthulhu_ 3y agoThat last one would be an interesting repository of revenge porn, although it's illegal to distribute it in a lot of jurisdictions. Although, maybe it could be a database of facial recognition hashes from revenge porn, and you can upload a similar hash of your own face to see if you're online somewhere?
- dylan604 3y agoIt just proves that rules of the internet work. If it exists, there's a porn version of it.
- Xorakios 3y agoMost online innovations were because of porn
- moose44 3y agoFor those privacy focused, here's how you can remove your information from their public search ability. https://haveibeenpwned.com/OptOut https://haveibeenpwned.com/OptOut
- layer8 3y agoYou have to solve a Google ReCaptcha though, which privacy-focused folks won’t like. Also, just FYI, “The controller of the domain your email address is on will still see you in domain searches.”
- randunel 3y agoTo merely use the service, you have to solve a seemingly infinite cycle of hcaptchas from cloudflare, this recaptcha is much more decent to users from 3rd world countries!
- deleted 3y ago[deleted]
- ziddoap 3y agoSeems slightly useless to opt-out of HIBP when your email is still in Collection #1 or Anti Public Combo List or whatever. Anyone wanting to do something nefarious with the emails will surely download the full source lists rather than try and scrape the aggregation site.
- blibble 3y agohe's become a very tempting target in himself that gets more tempting with each additional database added I wonder if he actually deletes the data...
- toomuchtodo 3y agoThis is a call for service providers in these dumps to move to Passkeys faster, not for the data to be redacted or censored. You want to decay the value of the credentials as rapidly as possible once exposure has been determined. This aligns with NIST guidance around secrets rotation. Once a breach is determined, all of these passwords should be invalidated immediately and require a password reset if you're so behind you're not offering Passkeys or SSO. Rate limiting will slow credential spraying attacks, but the only way to eliminate them is to use SSO ("Login with") or Passkeys. You are negligent as a provider if you are not invalidating leaked credentials in a timely manner. https://pages.nist.gov/800-63-FAQ/#q-b05 https://pages.nist.gov/800-63-FAQ/#q-b05 > “Verifiers SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.” > Users tend to choose weaker memorized secrets when they know that they will have to change them in the near future. When those changes do occur, they often select a secret that is similar to their old memorized secret by applying a set of common transformations such as increasing a number in the password. This practice provides a false sense of security if any of the previous secrets has been compromised since attackers can apply these same common transformations. But if there is evidence that the memorized secret has been compromised, such as by a breach of the verifier’s hashed password database or observed fraudulent activity, subscribers should be required to change their memorized secrets. However, this event-based change should occur rarely, so that they are less motivated to choose a weak secret with the knowledge that it will only be used for a limited period of time.
- mike_d 3y agoIt is worth noting the user awareness impact HaveIBeenPwned has had. On the other hand, I feel like SpyCloud does not get enough credit for having a dataset 30x bigger and working directly with companies to actually mitigate credential reuse. If you've ever been prompted at login to a major website or received an email asking you to reset a password because it was used in multiple places, there is a good chance SpyCloud is behind it.
- ziddoap 3y ago>On the other hand, I feel like SpyCloud does not get enough credit for having a dataset 30x bigger and working directly with companies to actually mitigate credential reuse Not sure if it is your intent, but this implies that HIBP does not work directly with companies to mitigate credential re-use. It does. Some examples would be their partnership with 1Password and other password managers, Firefox, their partnership with the FBI, UK & Australian governments, etc.
- mike_d 3y agoIt would be like comparing HN to Facebook, they are both technically operating social media sites but I don't think anyone would argue they are doing so at the same scale. HIBP ultimately is a hobby project that was really good at bringing the publics attention to the problem and booting Troy's social profile.
- heroprotagonist 3y agoIn the past decade, I wonder how many stalker victims have discovered HaveIBeenPwned as the easy directing tool that their abuser used to discover and invade their accounts and privacy.. Yes, yes, I know, the site maintains that it's the victim's responsibility, prior to any bad actor taking advantage of the service, to sign up and then disable their information from showing up in the search. Because the shock and awe of other users seeing 'Your info is out there!' immediately after entering their address, instead of after some kind of email verification, is more important than user safety.
- Kwpolska 3y agoE-mail verification would make the service much more costly to run, maybe not sustainable. If you’ve got someone’s email address, do you really need HIBP to figure out where it’s used? Wouldn’t Google give you a lot of results already?
- heroprotagonist 3y agoYes, you enter an email and you get a list of the hacks it's been found in, along with the type of data that's in the data breach. At that point you just go grab the data breach from some other location and pull the data. Including passwords, which will often be reused across other services and give you access to other accounts. The breach data (or subsequent accounts accessed from the passwords) may have a lot of additional data, like location, personal preferences, message contents, etc.. It's _much_ more impactful than simply Googling someone's email address.
- tokamak-teapot 3y ago“Just go grab the data breach from some other location” Do you have examples you can point to where this has happened? I would be interested in cases where this kind of approach has been taken, as my intuition is that Troy’s service wouldn’t make this significantly easier or cheaper.
- 3y ago
- prepend 3y agoI really like his informative posts. I remember reading about how he used k-anonymity to check passwords against the pwned file without having to transmit the passwords and it led to me studying that and later using it for some professional projects. I sometimes think what I would have done had I never read his posts about checking without transmitting real PII.
- gnyman 3y agoThe k-anonymity is such a clever trick, I remember being impressed by the simplicity and efficacy of it back when I read about it also. I'd also like to call out the one who Troy says suggested him [1], Junade Ali who goes into more details about this in his post about it [2] Not because Junade would have invented it (apparently that was Pierangela Samarati, Latanya Sweeney and Tore Dalenius. [3]) but because his blog post on it is a really great explainer of it using concepts software developers are familiar with. [1] https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v... [2] https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with... [3] https://en.wikipedia.org/wiki/K-anonymity https://en.wikipedia.org/wiki/K-anonymity
- adameasterling 3y agoTroy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from credential stuffing/password re-use. It's really surprising to me when I hear that huge companies don't do this check.[2] It's simple, easy, takes about a day to set up. If you're a young CTO or early-stage engineer working on a web app and have never been targeted with a credential stuffing attack, let me tell you: It's coming! It's just a matter of time before it's 1AM and your phone blows up; your site is getting hammered; you think it's DDOS, but then realize most of the hits are on your login page, then realize that and then realize with a horrible feeling that some % of those hits are getting through the login page. You'll be up all night dealing with it, and then you have to make breach notifications, and that really sucks. Troy Hunt's free database will save you that heartache (probably). Just do it. 1. https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html https://cheatsheetseries.owasp.org/cheatsheets/Credential_St... 2. Like 23andMe. https://news.ycombinator.com/item?id=37794379 https://news.ycombinator.com/item?id=37794379
- LeifCarrotson 3y ago> ... and then realize with a horrible feeling that some % of those hits are getting through the login page. The alternative is the exact same scenario, except that the percentage is several orders of magnitude lower, right? The small subset of your users that explicitly opted-out of 2-factor authentication (if you allow that) and who try to choose "Password1!" with a second exclamation point when your site said "Error, your password has seen 83,000 times in password dumps, please use a unique password" will still get hacked. Or is your expectation that no one will attack every user on your webapp with a credential stuffing attempt if they see that the probability of success is 0.001% instead of 1%?
- mulmen 3y agoThe bad feeling comes from knowing you could have reasonably done something to mitigate the harm. Don't let perfect be the enemy of good. Remember that "identity theft" is marketing fluff. In a credential stuffing attack your business is the victim of fraud.
- craignatic 3y agohe shouldn't have mentioned goatse, or told me not to google it. my curious brain took me to a rabbit hole where several times i wished i didnt have eyes.
- IsoldesKnight 3y agoLet me be the one to tell you not to look up tubgirl or meatspin. The turn-of-the millennium internet was a dirty place.
- TruffleMuffin 3y agoWhen you know how old someone is by the fact they don't know any of those things.
- m4jor 3y agomake lemon parties great again
- jimmySixDOF 3y agotoo true and for some reason there was a rule like the worse the content the faster it would download/torrent/kazaa/limewire/etc lol
- Cthulhu_ 3y agoOh you sweet summer child.
- dylan604 3y agowhat's the learning curve of a GenZer? When boomer says don't look this up on the internet, it's not because they want the information for themselves. It's because they already have something burned into the memories, and are hoping to save you from the same.
- unaindz 3y agoIt's human nature to be curious and nothing to be ashamed of. And if someone really doesn't want you looking into something, they won't even mention it.
- hk1337 3y ago> I get on my jet ski and I do whatever the fuck I want Is Troy Hunt a Mobius variant?
- Lwafezwa 3y ago[flagged]
- wharvle 3y agoReminds me I really need to do something about those checks notes 99 compromised accounts in my password manager.
- agentultra 3y agoBlackmail scammers have been using pwned password databases to craft some pretty convincing phishing emails ("I have installed RAT on your system and have been watching you through your webcam, proof I hacked you: <old password from pwned passwords> -- send $1800 of BTC to this address and don't go to the police. Maybe use a password manager next time."). Do people get caught in these scams? I assume most get blocked by spam filters. I've only noticed them when they get past SPI/DKIM filtering and I have to train more. They seem pretty clever. I appreciate the service and enjoy Troy Hunt's posts. HIBP is great.
- tercmd 3y agoThe Pwned Passwords lookup returns just the number of breaches without any hashes or plaintext passwords. This would not make such an attack possible.
- agentultra 3y agoThat’s good to know. So they’re probably using old dumps.
- _benj 3y agoI mean, I once got an email with my password in plain text and it was pretty disturbing. I did a quick search and realized that that password wasn’t used in anything I cared about so, I just went about my day, still disturbed but knowing that it’s an old password. I can’t imagine how it would feel if I didn’t use a password manager and couldn’t quickly see where was that password used instead of wreaking my brain trying to remember!
- cafard 3y agoCaught, I can't say. I have heard of users becoming alarmed and running to IT for reassurance. I got one or two of these emails, and couldn't for the life of me guess on what sites I had used the (pretty weak) passwords.
- mtmail 3y agoA family member called me in distress asking if the email is legic. It had his full postal address and last 4 digits of a credit card (not an old password). People do believe it.
- Vicinity9635 3y agoAnybody been in more than 20 data breeches? All my stuff's been locked down with a password manager/2fa so I'm not worried, but having been on the internet for ages it's pretty funny at this point.
- wrboyce 3y agoI appear to be up to 47 now. The last time this was asked on HN (Feb 2018) I had 13 breaches and appeared in one “paste” - https://news.ycombinator.com/item?id=16465030 https://news.ycombinator.com/item?id=16465030
- iamacyborg 3y agoOne of my accounts is apparently in 32 breaches
- xboxnolifes 3y agoMy childhood-turned-throwaway email has been involved in over 30 breaches according to the site. A lot of them are forum related.
- aaronharnly 3y agoI use a separate email address with every site, so I can be confident that each the below is a wholly independent breach. I've had email addresses (and sometimes other data including name, password or password hash, etc) breached from: Adobe.com Bit.ly Bytargentina.com Cafepress.com Chegg.com Contentful.com (via Apollo) Dailymotion.com Disqus.com Dropbox.com Edmodo.com Facebook.com (via Zynga) Gawker.com Invisionapp.com (via Apollo) Kickstarter.com Last.fm Linkedin.com Linux-mag.com (via QuinStreet) LiveAuctioneers.com Monster.com (via Apollo) Myfitnesspal.com Parkmobile.com Streeteasy.com Teespring.com Ticketfly.com Ticketmaster.com (via Ticketfly) Tumblr.com Xbmc.com (via Kodi)
- Sephr 3y agoI have memories of this site providing me with an excellent experience. Now it's just a cash-grab, asking for $169.50/year just to see 100 breached accounts! I use unique email addresses (breach canaries) on every website to detect when sites leak my data. When I tried to search for my domain results with a previous domain ownership verification, I got hit with this error: "In order to search a domain with any more than 10 breached accounts on it, you need a sufficiently sized subscription" To make matters worse, Troy includes public data compilations as 'breaches' which artificially inflates counts for the breached accounts quota. For example, when a compilation of public contact details scraped from GitHub leaked, Troy counted that as a breach. I explicitly listed my email address as public. I'd be willing to pay $5-12/year. These rates are outrageous for such a low-overhead service.
- benced 3y agoYou’re doing a weird thing (running your own email domain), doing an even weirder thing (using a different address per site), and then doing an even more weirder thing (scanning your personal domain for breaches) and your supposition is that very specific use case is a cash cow for Troy Hunt? Come on.
- Xorakios 3y agoIt is preferred practice, not a weird thing, to have a dedicated domain and a different address per site for anyone involved in online security research.
- dotancohen 3y agoI do the exact same thing. Every site, service, and contact gets a personal something@mydomain email address to reach me.
- cheschire 3y agoSomewhere in the distance, the Count from Sesame Street says "TWO... ah ah ah..."
- 3y ago
- nojvek 3y agoHas he written much about the specifics of the divorce? I assume it was about 50% split of assets and figuring out who owns what that made it lengthy and expensive?
- djaouen 3y agoNo matter what anyone says, I am not going to type my password into a site called “Pwned Passwords” lol
- tercmd 3y agoThe k-anonymity API makes it such that the password doesn't have to be sent to HIBP, but the first 5 characters of its SHA1 hash. This returns a list of possible suffixes which can be checked for the actual password to see how many have been breached. For example, a search for "abc" with the hash "a9993e3...89d" becomes: `curl -s https://api.pwnedpasswords.com/range/A9993 https://api.pwnedpasswords.com/range/A9993 | grep -i e364706816aba3e25717850c26c9cd0d89d` which returns `E364706816ABA3E25717850C26C9CD0D89D:226273` indicating that the password has been seen 226,273 times
- guenthert 3y agoAnd this isn't complete and utter bullshit? My e-mail address (after requiring JS and cookies) was allegedly found in an collection of avatars ... I'm sure it's now in a collection I rather not have it in.
- guenthert 3y agoWell, for the record, google confirmed that my e-mail address (and other PII) was found in the other two listed breaches, but didn't know about those avatars either.
- jaykaypea 3y agoI love this so much! Congrats Troy on a decade!!