19 ms·
Have I been pwned? Check if your email has been compromised in a data breach
- dudus 13y agoWhat about this one? http://blog.spiderlabs.com/2013/12/look-what-i-found-moar-pony.html http://blog.spiderlabs.com/2013/12/look-what-i-found-moar-po...
- kanwisher 13y agoNice been looking for a tool like this, so I didn't have to download each of these hacks lists
- sp332 13y agoAn introductory blog post: http://www.troyhunt.com/2013/12/introducing-have-i-been-pwned.html http://www.troyhunt.com/2013/12/introducing-have-i-been-pwne...
- vladd 13y agoAny plans to add LinkedIn?
- sp332 13y agoI thought emails weren't disclosed in the LinkedIn breach? You can check your password over at https://lastpass.com/linkedin/ https://lastpass.com/linkedin/
- oal 13y agoLastPass has a similar service for some of the recent (and not so recent) hacks: * https://lastpass.com/adobe/ https://lastpass.com/adobe/ * https://lastpass.com/linkedin/ https://lastpass.com/linkedin/ * https://lastpass.com/lastfm/ https://lastpass.com/lastfm/ * https://lastpass.com/eharmony/ https://lastpass.com/eharmony/
- acheron 13y agoThanks for that; I had ignored the Adobe leak, because why would I have created an Adobe account? Turns out I did at some point, so I guess I'm the goat there.
- mcv 13y agoOften you need to create an account or somehow register your email at sites, just to get something very basic, like a free download, or use a feedback form. This demonstrates nicely why that's a bad idea.
- aestra 13y agohttp://www.bugmenot.com/ http://www.bugmenot.com/ is useful for such a case, registration required for a download.
- ElongatedTowel 13y agoI entered my address out of curiosity and it told me I had an Adobe account. I can't remember ever creating one so I tried the password reset process. Adobe tells me there doesn't exist an account under that address. How is this possible? How did Adobe leak my address if I don't even have an account?
- joosters 13y agoIf you use LastPass, then their security check will run these checks automatically against all leaks and email addresses: http://blog.lastpass.com/2012/01/new-years-resolutions-with-lastpass-1.html http://blog.lastpass.com/2012/01/new-years-resolutions-with-...
- milkmanjr 13y agoAwesome. The LastPass checker is really nice. Whats scary is that it found a few other people that had the same password as me. For the Adobe breach, LastPass also emails you a sample of the password hints of others -- its kind of funny how people remember a certain string.
- TheLegace 13y agoThe crazy thing my simple password was used by 5 other people. Luckily my email password is much more complicated.
- deleted 13y ago[deleted]
- jwallaceparker 13y agoAnd then this happened: http://www.bbc.co.uk/news/technology-25213846 http://www.bbc.co.uk/news/technology-25213846
- znowi 13y agoIs this a clever way to harvest email addresses? :)
- rshm 13y agoThey should have instead used digest to store and transfer the email addresses.
- denzil_correa 13y agoNo Passwords: I’m not storing them. Nada. Zip. I just don’t need them and frankly, I don’t want the responsibility either. This is all about raising awareness of the breadth of breaches. http://www.troyhunt.com/2013/12/introducing-have-i-been-pwned.html http://www.troyhunt.com/2013/12/introducing-have-i-been-pwne...
- rallison 13y agoConsidering that this is made my Troy Hunt, I would trust it. He has built up enough reputation in my mind.
- staunch 13y agoYou suck Adobe.
- josh2600 13y agoIf you want to see what it looks like when your email address has been pwned I tried lol@lol.com and got back 4 hits.
- danso 13y agoI have a question...how big is the backend to this site? Its average response is about 100ms, which, to me, seems impressively fast considering the number of bulk records and the amount of concurrent traffic that such a site is getting. Besides the obvious indexing of the email field...anything special behind the curtains? Lots of machines? Something else besides a simple key lookup? Or am I just vastly overestimating how slowly a properly maintained DB will respond in such a situation?
- mountaineer 13y agoHe discusses a little in the intro post[1], but indicates he'll be writing a technical detail post too. [1] http://www.troyhunt.com/2013/12/introducing-have-i-been-pwned.html http://www.troyhunt.com/2013/12/introducing-have-i-been-pwne...
- dudus 13y agoI think you are overestimating. This is not so large and unique key searches are blazing fast in pretty much any DB under the sun.
- troyhunt 13y agoThis might answer your question: haveibeenpwned.com/HowFastIsAzureTableStorage/?email=foo@foo.com I'm writing up how the back end is done and will post it in the next day or two, IMHO it's massively impressive but also very easy :)
- danso 13y agoLooking forward to it! The raising of awareness about security is alone pretty awe-inspiring, so the fact that I'm equally piqued by such technical details as the site's backend is really saying something about the impressiveness of the execution
- troyhunt 13y agoTry this: http://www.troyhunt.com/2013/12/working-with-154-million-records-on.html http://www.troyhunt.com/2013/12/working-with-154-million-rec...
- wil421 13y agoAdobe got me. Does lastpass work great for checking banking on cellphones and other logins that would require a cut and paste on a desktop?
- jacalata 13y agoThey have a mobile site, and if you get the premium subscription ($12/year?) you can use their mobile apps - I use the iOS and Windows Phone apps and both are very smooth. (They also have Android and Blackberry).
- lurkinggrue 13y agoI use lastpass on my android phone. I use 2 factor with an nfc yubikey. http://www.yubico.com/products/yubikey-hardware/yubikey-neo/ http://www.yubico.com/products/yubikey-hardware/yubikey-neo/
- ufmace 13y agoYup, works great, I've been using it for over a year. To login to banking on your phone, you first go to the Lastpass app, login to that, then copy the password to your bank, open their app, and paste the password in. Lastpass for Android also now has a notification that stays up while you're logged in, to remind yourself to log back out when you're done.
- BlackDeath3 13y agoThat's the way that it worked when I first started using it, but am I the only person using the full Lastpass browser these days? It's far more convenient than the old Authenticator -> Lastpass -> Browser authentication workflow that I had to use before the upgrade.
- zoul 13y agoIt’s a bummer to find my e-mail between the leaked Adobe accounts. Especially after the ordeal I had to go through to have my Adobe account “deleted” months ago: You have requested that we deactivate your Adobe account. We have sent a request to the relevant team to process your request. Please note that you will lose access to Adobe services and support for which you have registered or paid for. You will not be able to obtain serial numbers for past purchases and the deactivation process may take up to ninety (90) days. Once completed, your adobe.com membership and all personal data will be deleted from our database. Adobe, every single time I had anything to do with you it sucked. Big time.
- stevekemp 13y agoIt took 120+ days for my ebay account to get deleted, but thankfully I could delete my paypal in only a few weeks.
- Crito 13y agoThe 120+ days thing with ebay is allegedly because they need to make sure any outstanding deals are closed and accounts settled. Of course that is absolute bullshit, it took them 120+ days to close my account and I had not used it for over 4 years at that point. They actually emailed me telling me that they were closing the account due to inactivity. They gave me 3 or 4 months to log on before it would be killed, so I thought to myself "good, saves me the hassle of doing it myself". Fast forward 3-4 months and I get an email telling me my account was compromised. Weird... so I log on, confirm any payment info I had was long since expired, confirmed nothing had happened and that my password was intact... then I scrambled the security question and password just to be safe and told Ebay to delete the account. Cue "this will take 120+ days" bullshit... but whatever. At nearly the end of that 120+ days I get emailed again telling me the account was compromised. I'm convinced this is a scam they run to trick you into logging into your account, thus resetting the the countdown. Ebay and paypal are among my least trusted companies. I have a higher opinion of even Comcast or Halliburton.
- pdenya 13y ago
- wfunction 13y agoWho's to say these guys aren't stealing our emails?
- aaronblohowiak 13y agoyour email is not a secret.
- AznHisoka 13y agowell, if you decide to list it under your HN bio, then obviously, it's not :)
- lexalizer 13y agoBut it's not public information either, unless you choose to make it public.
- mhurron 13y agoNo, but it can be harvested for directed attacks or spamming. Entering it would basically 'prove' it's a valid address.
- manmal 13y agoThe Adobe leaks list is mostly made up of verified emails, so... Coming to think of it, there has been some spam lately (though that hasn't happened in years now at gmail), and I wonder whether it's related to that Adobe leak.
- mhurron 13y agoAh, but by checking if your email is compromised, they get even more emails then they did just from compromised sources.
- dredmorbius 13y agoOn a risk / reward basis the benefit to checking here is actually pretty high. I don't find any of several accounts I use on there, but did find a friend's email listed (and just notified him). I'd actually appreciate a way to query my mailing list in an automated fashion.
- mrleinad 13y ago"How to collect e-mail addresses" - Exercise 1
- saym 13y agoFunny that example@example.com has been pwned twice.
- midnitewarrior 13y agoexample.com is a special domain, not to be used for any legit purpose, so good luck hacking that! http://tools.ietf.org/html/rfc6761 http://tools.ietf.org/html/rfc6761
- saym 13y agoI'm aware, that's why I wanted to see if people were using it for their accounts.
- hornbaker 13y agojohn@doe.com and fuck@off.com can beat that - pwned three times each. See also noneofyour@business.com.
- danso 13y agoThis is an impressive service (the speed, especially)...collation of different data sources into one easily accessible form is a hugely useful and underrated service. That said...there's no such thing as better security without an equal tradeoff. Here, it's now much easier (especially with the site response speed) for a third party to look up email addresses, see who they've patronized, and aggregate them into a database of less noble intent. To check if a given email address was an Adobe/Gawker/whatever customer, you would've not only had to query every separate form but you would also not be guaranteed to get a definitive response (because some services will be ambiguous to whether you got a password wrong or whether the account exists at all). With the OP's service, with positive hits, you not only get confirmation of patronage, but knowledge that they are vulnerable, even if in a small, outdated way. It's likely something Troy has anticipated but didn't want to outright say...In the end, knowledge is better than ignorance, and the correct response is for more rapid response to hacked victims and better security awareness. But I also wonder if there's a way to provide the OP's service with more (beneficial) obfuscation?
- ericlewis 13y agoWhoa, slow your roll buddy. This could be really easily done by preprocessing the data and creating simple objects in redis. One object = email, sub objects of email could just be flags for the service it's on.
- danso 13y agoIt's not the processing that's the bottleneck, it's the gathering and the initiative to do that gathering which is rare. For example, criminal records and notices have always been collectable and, once collectable, searchable. But the incidence of "a prospective employer googled me and found a 5 year old article of me publicly urinating in college" became more of an issue in the age of Google. This isn't an indictment of Troy at all, just an observation (and I'm also just curious about what mitigation could be done, if any, that wouldn't severely inconvenience the end user). The security that exposed people had was security through obscurity, which is in the end, not enough security.
- dysoco 13y agoI got my Adobe account pwned, apparently. I didn't even know I had an Adobe account, I don't use any Adobe products.
- l0c0b0x 13y agoNormally wouldn't trust this, but: http://www.troyhunt.com/ http://www.troyhunt.com/ http://www.intodns.com/haveibeenpwned.com http://www.intodns.com/haveibeenpwned.com (forwarded from haveibeenpwned.azurewebsites.net) http://www.whois.com/whois/haveibeenpwned.com http://www.whois.com/whois/haveibeenpwned.com Seems legit.
- brc 13y agoTroy Hunt has been blogging about this for a while. Troy is a good guy who blogs extensively on security matters. I don't see any risk in putting your details in here. His recent posts on pwning peoples phones and tablets while they were at his conference talk are pretty amusing. Shows just how insecure things really are.
- albemuth 13y agoThey could just query against the MD5 of your email instead, if it's a match they already had your email anyways :)
- cm2012 13y agoThis is very cool. I didn't even think of my adobe account when the breach happened, since I used it so long ago.
- cleaver 13y agoI tend to create a new email address for everything I sign up for. This makes a little harder to check :) EG: twitter@example.com, facebook@example.com, hackernews@example.com It also makes it a little harder for people to find me on social media. Not sure if that's a bug or a feature ;)
- rfnslyr 13y agoSame here, with completely randomized passwords 60 chars long and different emails. IM INVISIBLE!
- denzil_correa 13y agoShould I Change my Password is a push service which notifies if your account is compromised and sends you an e-mail to change your credentials [0]. Cool hack btw! The only thing missing is a "What to do" link which could be more useful for folks who are not so technically savy. [0] https://shouldichangemypassword.com/ https://shouldichangemypassword.com/
- 3rd3 13y agoIs it possible to apply the same hash function to a string as it’s done in the users database of the Adobe breach? I think it is 3DES. I’ve been able to obtain my (hashed) credentials, but as it seems my account is deactivated at adobe.com (probably due to inactivity?), so I’m not able to test which password I used. :(
- maxerickson 13y agoThe key is not publicly known. Some passwords have been recovered, as discussed here: http://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-password-disaster-adobes-giant-sized-cryptographic-blunder/ http://nakedsecurity.sophos.com/2013/11/04/anatomy-of-a-pass... It would be irresponsible for anybody to share the key, it would reveal all the passwords.
- deleted 13y ago[deleted]
- pvnick 13y agoShit. Looks like I got caught up in the adobe breach. Let this be a lesson to all engineers in charge of such situations to implement strong security. You are partially responsible for these disasters. I got a call from PayPal a week or two ago. It turns out somebody in Indonesia accessed my Paypal account, presumably with credentials scraped from adobe. I know, I know, shame on me for reusing passwords. Luckily no damage was done and I did a change to the strongest password I've assigned anything yet. Great job, op (if you're the one who wrote this service) for such an amazing tool. Everyone, if you haven't already, you really should check if you've been compromised. I will be sending this to all my friends.
- redidas 13y agoI woke up this Thanksgiving with a bunch of email notifications from Paypal that my account had been hacked and taken over. I (also shame on me) tend to reuse some of my passwords, and figured someone got into my Paypal account using my adobe credentials, not even being sure if I had created an account with adobe for anything in the past. I checked my email address on this site and it didn't find any pwnage. I'm relieved my email address isn't in any of these leaks, but also now concerned about whatever it was that let someone into my paypal account so easily...
- mcv 13y agoIf you reuse passwords, separate throw-away accounts (like Adobe or pretty much anything that's not your email, your bank or PayPal), from the important stuff. Sites that need to be secure, hopefully really are secure. Sites that don't really need to be secure because they don't deal in anything of value, probably don't invest quite as much in security. Reusing passwords across those different kinds of sites means the extra security of the secure sites is wasted. Of course it's way better not to reuse at all, but remembering two or three passwords is a lot easier than dozens, and still a lot safer than just one.
- da_n 13y agoThis should be a lesson not to manage your own passwords, use a password manager there are many to choose from. I was also caught up in the Adobe breach but my password was randomly generated by my password manager.
- easy_rider 13y agoFor some reason I always forget I have an Adobe account.
- maerF0x0 13y agoalso: https://pwnedlist.com/query https://pwnedlist.com/query
- borski 13y agoWe send emails to all of our customers who end up in these breaches as well.
- elorant 13y agoFor cases like these are why you should NEVER
- cortesoft 13y agoNever finish your comments?
- elorant 13y agoFor cases like these is why you should NEVER use the same password in different sites. While my email is in the Adobe list the password I used there is unique so I don't bother too much-other that I've lost any trust in Adobe and I'll think twice about doing any business with them in the future.
- k4st 13y agoAs someone who was 'pwned' by the Adobe leak, I have no idea how bad the pwnage was. That is, I don't recall what my Adobe password was, and so I have no idea which of my many passwords was compromised. Also, I partially went through the Adobe password reset procedure two or three times--each time guessing at what my original password was. Unfortunately, they accepted all of my guesses, so I was still none the wiser about which password was compromised. To top the entire ordeal off, Adobe was not the one to tell me that my password was compromised. Instead, my hosting provider and some other services notified me.
- sliverstorm 13y agoSame boat. Don't remember if it's an email/password combo I still use.
- TillE 13y agoYeah, I'm downloading the leak and trying to check if I can deduce whether it was the common I-don't-care password I think it was. A couple other people had used the same password, but the hints didn't help me. http://security.stackexchange.com/questions/45413/how-do-i-decrypt-an-adobe-triple-des-ecb-mode-encrypted-password http://security.stackexchange.com/questions/45413/how-do-i-d...
- finnw 13y ago> I don't recall what my Adobe password was This will tell you your password hint (and if any other user had an identical password, you will see their hint also. ) https://lastpass.com/adobe/ https://lastpass.com/adobe/
- acolavin 13y agoThis is a great service -- I've already shared it with my colleagues. But doesn't this tool now make it easier for those with a grudge to find their enemies' compromised accounts? ...all the more reason to change your passwords...
- peterwwillis 13y agoFor those freaking out about somebody "misusing" this information (your e-mail address) .... I have some bad news. E-mail addresses are not secret. They cross the wire in plaintext, they get stored in various mail server logs in various relays across the globe, they get passed around by spam analysis services, anti-virus services, and any company you submit it to has the right to sell it and any other information about you to anyone they want, without your consent. "Although partial regulations exist, there is no all-encompassing law regulating the acquisition, storage, or use of personal data in the U.S. In general terms, in the U.S., whoever can be troubled to key in the data, is deemed to own the right to store and use it, even if the data were collected without permission." [1] California is one of the few (only?) states with privacy laws, and it basically just says companies must post a privacy policy and follow it - and that policy could, for example, say they are allowed to sell on your information, which i'm sure 99% of companies would opt for. Your e-mail address alone is not worth much in a general sense. In terms of spammers, they already have all the e-mail addresses in this list. And if on the off chance this guy's service is "selling" e-mail addresses to spammers (at what... $0.10 per e-mail address?), are you really so afraid of someone sending you spam? [1] https://en.wikipedia.org/wiki/Information_privacy_law#United_States https://en.wikipedia.org/wiki/Information_privacy_law#United... For more information about all the other personal information about you that isn't private, see https://epic.org/privacy/profiling/ https://epic.org/privacy/profiling/
- beering 13y agoHi, two things. People knowing that you have account yyy@example.com at example.net could use that information in a spear-fishing attack, or know that you're involved in a controversial website, prohibited website, etc. Emails were not the only things that were stolen. For example, in the Adobe breach, encrypted passwords were stolen. If your email address is shown as being in the Adobe breach, that also means that your encrypted password, password hint, etc. were stolen. For Sony, maybe credit card information. If this website was only about whether email addresses were leaked, then why would anyone type in their email address into this website (thus leaking your email)?
- dmckeon 13y agoOTOH, California was the first of many US states to require disclosure or notification of personal information security breaches, https://en.wikipedia.org/wiki/Security_breach_notification_laws https://en.wikipedia.org/wiki/Security_breach_notification_l... and will soon be requiring disclosure of breaches of "personal information that would permit access to an online or email account" https://www.huntonprivacyblog.com/2013/09/articles/california-bill-would-require-notification-for-breaches-involving-online-account-credentials/ https://www.huntonprivacyblog.com/2013/09/articles/californi...
- Joeboy 13y agoI am in the habit of making up email addresses on the fly when I register for things. Looking in my spam folder, in the last couple of days I've had spam to the email addresses I submitted to Adobe, Groupon and Abbey National Bank (now Santander). As people have pointed out email addresses are not secret, but if they've leaked out of these businesses' databases it's a bit worrying what else they might be leaking.
- benjamincburns 13y agoI'd like to see a site which validates whether or not your password is exposed. Users should assume that it is exposed, but it would be nice to know wether or not it's floating around in some list somewhere. Problem is, I can't think of a computationally efficient way to perform this check securely. I could see handing the user an nonce, asking them to manually hash their password concatenated with the nonce, and then comparing the user's response with a list you've hashed yourself, but I'm sure this won't scale well. Is there such a thing as a secure, or "blind", bloom filter which allows a user to search for some chunk of text without exposing to the world what that chunk of text is? Edit: Hmm, this might be what I'm looking for: http://www.tdp.cat/issues/tdp.a015a09.pdf http://www.tdp.cat/issues/tdp.a015a09.pdf
- jrockway 13y agoIt's possible to write a tool that will figure out all algorithms/salts used by compromised sites, and then hash your password with those algorithms/salts and see if that hash appears in the compromised password files. Most of the compromised sites use worthless password storage mechanisms, like unsalted hashes or plaintext, so this level of sophistication is mostly unnecessary. For example, say you used the password "foobar". md5 that: $ echo -n "foobar" | md5sum 3858f62230ac3c915f300c664312c63f - Then Google for 3858f62230ac3c915f300c664312c63f. The first result's snippet is: = rainbow.lookup('3858f62230ac3c915f300c664312c63f') # => 'foobar' ... There you go. Don't use "foobar" as your password.
- jason_slack 13y agoYou've got me thinking about how I store passwords. I have in the past done: ~ $ echo -n "mypassword" | base64 bXlwYXNzd29yZA== How would one combine the above with md5? on OS X is it `md5 -s <string>` So basically base64 'mypassword', then md5 the base64 result.
- benjamincburns 13y agoOh god, I hope you're joking. http://www.codinghorror.com/blog/2007/09/youre-probably-storing-passwords-incorrectly.html http://www.codinghorror.com/blog/2007/09/youre-probably-stor...
- cabbeer 13y agoGmail also tells you you'r Last account activity at the bottom of the page.
- pcx 13y agoIs it possible to find the actual data? I found an old email in there, would be interesting to checkout what lame hint I used.
- berlinbrown 13y agoAdobe....
- berlinbrown 13y agoAdobe....
- deleted 13y ago[deleted]
- nashequilibrium 13y agoMy gmail was fine but my yahoo mail is compromised, but i actually changed the password a couple weeks back because yahoo asked me, so worked out fine. I have not used adobes services for over a year now.
- Udo 13y agoFunny/scary anecdote I experienced a few days ago: most Linux flavors check against the cracklib database when changing passwords, and as I typed in an account password, a brand-new cracklib said it was based on a dictionary word. Now, my passwords are alphanumerical jumble, and they're usually comprised of an alphanumerical jumble "core" that I memorize and then a site-based or computer-based pre- and suffix. So, let's say for example, my current core is "kgA85kjF3". Then for example, I'd morph that for my Hacker News account to "ZkgA85kjF39!" and my fileserver as "UkgA85kjF3O2". I thought this was a good method of having reasonably long passwords but I'd have to memorize very little per site. So imagine my surprise, when I created a new password "NkgA85kjF3T3", cracklib found a dictionary word in it. It got worse from there. Through experimentation, I determined that it was indeed the core that was compromised. Any password containing "kgA85kjF3" was compromised. I have no idea how this happened. If this was not a big cosmic coincidence, if this is not just a random regex filter accident, that means data from at least two known password databases containing my cores has been correlated, and put into cracklib no less. There is really no limit to the imagination regarding what illegitimate databases might contain...
- icebraining 13y agoI do something similar, but I then hash the result and use that as the password. That way, if someone gets hold of a couple of passwords, it's harder to derive the "core'.
- Udo 13y agoThat's a good procedure, a few weeks ago I'd have deemed you paranoid but obviously there is no practical limit to paranoia anymore ;) However, the hashing step makes it impractical for me on different devices in certain situations. I don't want to rely on browser extensions or apps either. So I'm changing my passwords to the output of an algorithm I can do in my head now.
- brandynwhite 13y agoFor those who aren't aware https://www.pwdhash.com/ https://www.pwdhash.com/
- adelevie 13y agoWhere's the API?
- w-m 13y agoThat Adobe got hacked isn't your fault - that you chose a weak password and reused it, is. Showing a few more numbers might help more people realize that their passwords aren't actually unique, creative or safe. The data that came out of the Adobe hack is pretty interesting, and the results are much more tangible than "oh no, pwned!". Something like: "Your password was used by 8290 people. Furthermore, 2615 persons gave a plain text hint as to what the password might be."
- mdxn 13y agoThis database includes emails that were simply listed in these data breaches. Newer Adobe account emails were put in as entries in the database, but their associated password/hint data was not. There were quite a large number of these in the leaked db, including some of mine. I had to download the whole thing and search to realize that the only information revealed/stored was the email address.
- andy_ppp 13y agoIdea: Write a service that you pass the unsalted hash to (only salted hashes in the DB please), and the email address and hash type. Stop people if their hash matches any previous ones. Obviously this would stop people providing the same password for all services... But might creep some people out! Would hopefully highlight how insecure/guessable non salted hashes are. Does anyone know best practice for doing things like this?
- rickyc091 13y agoDoes anyone know the site that lists all the sites that have been compromised? Edit: Found it, this was the one I was looking for. http://dazzlepod.com/disclosure/ http://dazzlepod.com/disclosure/
- aaronsnoswell 13y agoThe real zinger - when you enter your email address to check, they store it and steal your identity :P
- 0utsider89 13y agoThis site is BS, I put in a BS email still say I was part of a adobe password breach!!!
- cynwoody 13y agoI got three hits for president@whitehouse.gov.
- vacri 13y agoPeople put in bogus addresses when they register for things. I have a domain that is similar to a common mash on the keyboard, and I get a steady stream of backscatter from people signing up to things with crap@keyboardmash.org.
- Nilzor 13y agoasdf.com? qwerty.org? Please don't leave us hanging :P
- philipb 13y agoeven if it was a BS email, it could have been a part of the db. you'd be surprised at the kind of BS email address in the adobe dump. there are ~1K people who provided an @a.com email address.
- sciguy77 13y agoGod damn it Adobe!
- gojomo 13y agoFeature request: allow wildcard searches, with a sufficiently large literal starting prefix, to return a simple "zero" or "more-than-one" result. EG: "john*@gmail.com" I'd then feel better about typing my address into a random site, and be able to check site-specific variants of my address more easily.
- legohead 13y agoYes! For every different site I use a different email address, so I know when something fishy is going on. so I might have hackernews@mydomain.com. The form wont accept just @domainname.com :(
- e40 13y agoAlso, for those of us that use aliases for each site we visit... it would allow a quick lookup of them.
- soperj 13y agoI find it amusing that my real email address are not compromised but all of my fake ones for signing up for various things are compromised.
- goshx 13y agoIs this a trap to build a mailing list? I tried a bunch of fake hotmail emails and 90% of them are "pwned". Very suspicious to say the least.
- goshx 13y agoThis sounds as much of a trap as do the websites that tells "how secure is your password" to use them to build dictionaries for brute force.
- gwu78 13y agoAside from those who enter fake addresses or addresses they do not control, the folks who set up websites like this can also connect each email address with an IP address. This might be useful, e.g., for determining geolocation. It is sad to think that naive users are falling for this every time a data breach makes the news, handing over their email address to total strangers.
- NicoJuicy 13y agoPawned on Adobe's website 2. My spam url and my real one, goddamned.
- Houshalter 13y agoIt says I haven't, yet if I google my email and an older password I used to use, I find it listed on some Russian forum.
- bdamm 13y agoFor the last 12 years or so I've been using unique email addresses. I have a catchall domain and established patterns for giving out email addresses. Over the years I've witnessed many companies either getting hacked or selling out their mailing list. I know this because I start to receive spam to these unique email addresses. Just this morning I discovered that Sirius XM has been hacked. Shame. It would make an interesting project to analyze all this history that I've built up.
- omegant 13y agoPwned on amazon too. Thankfully it was a demo account, with an old email and password.
- sltz 13y agoFor those who aren't aware https://chrome.google.com/webstore/detail/one-last-pass-password-ma/cnpobogcpnkgjpfjcmmgppgpmihanimo https://chrome.google.com/webstore/detail/one-last-pass-pass...
- samweinberg 13y agoWelp, I now know my login was apart of the Adobe leak. Shouldichangemypassword.com sent me an email a few weeks ago saying my email address was found in a leaked database, although they couldn't say which one. Considering I have more than 100 accounts which use that particular email address, it didn't help at all. This site did!
- bcuccioli 13y agoFeature request: Could you strip the dots from user input if the email address is @gmail.com, and similarly strip the dots from the records of pwned email addresses? Gmail usernames are dot agnostic, and I sometimes use xyz@gmail.com, x.yz@gmail.com, etc. This makes it hard to use the tool to check of my Gmail has been pwned. (Also, I assume you don't do this already).
- DigitalSea 13y agoThis site has done a good job highlighting just how badly Adobe screwed up with their data breach. Everyone in my office had their email address show up from the Adobe breach (including mine) and based on the comments, everyone else mostly did as well. Whoa.
- ionwake 13y agohttp://i1.ytimg.com/vi/4F4qzPbcFiA/maxresdefault.jpg http://i1.ytimg.com/vi/4F4qzPbcFiA/maxresdefault.jpg
- beefsack 13y agoI always have an uncomfortable feeling these exist purely to harvest email addresses. Not that it stopped me using it, the results are of interest and my email address is already plastered all over the place.
- Gustomaximus 13y agoI've started to sign up to sites with a unique email address based on the websites URL. E.g. If I signed up to Myspace I would use Myspace@exampledomain.com I have the mail server at "www.exampledomain.com" set to accept all emails under the domain so I can see if someone has passed on my details legitimately or via hacking. Since I've started about 12 months ago I've not found any cross pollination which seems a good sign for the industry in general. It also adds a layer of security as your sign-up email changes for different websites if you use the same password across several.
- code_duck 13y agoThe email I used for Adobe was caught in their breach. Good news? I not only used a different password, but I use a new email for almost every site. I have a wildcard email and Adobe is the only site I've ever used that particular email on. Meanwhile, my yahoo account (which I basically use for nothing) is not listed as being exposed, but I logged into that recently and had a note that it had recently been logged into from India. Good golly.
- damian2000 13y agoSeems pretty similar to this one from a year or two back... https://shouldichangemypassword.com/ https://shouldichangemypassword.com/
- nishantmodak 13y agoYou should also include dates alongside the breach. Just so that one knows, if they have taken corrective action after that
- DonGateley 13y agoAdobe needs to be extinguished.
- Gyy0 13y agoThis is what caused me to start using a password manager. I always knew that I should, but it seemed to be a major pain, if I had known how convenient it is, I would have switched to it long back. Instead I first started off with my own "password generator": import random import string import sys def generate_random(length, simple): chars = string.printable[:-6] if not simple else string.letters + string.digits return ''.join(random.sample(chars, 1)[0] for x in range(length)) def username(): return generate_random(length=4, simple=True) def password(length): return generate_random(length=length, simple=False) if __name__ == '__main__': length = 6 if len(sys.argv) > 1 and sys.argv[1].isdigit(): length = int(sys.argv[1]) for i in range(20): print username(), password(length)
- Gyy0 13y agoAnd lets also not forget, this why you should always use http://www.mailinator.com/ http://www.mailinator.com/ instead of your real address. Lots of sites block mailinator, but then use one of their aliases – foobar@spamgoes.in ... then check http://foobar.mailinator.com/ http://foobar.mailinator.com/
- wybo 13y agoThis looks like a brilliant way for spammers to collect e-mail addresses...
- jheriko 13y agohow do i know this isn't a scam for collecting e-mail addresses for spam purposes?
- relet 13y agoAm I the only one who is reminded of the "Has your credit card number been stolen? Check here!" phishing ads? Isn't there a better way to check for stolen addresses than to enter your email on a dodgy (hey, I followed a link on Hacker News) website? Such as calculating a hash on the client, and sending the hash for verification?
- deleted 13y ago[deleted]
- thrillgore 13y agoI got an email from LastPass about being caught up in the Adobe breach and it took me one evening, two cups of coffee, and a lot of patience to switch all my passwords to auto-generated strings and enable 2-factor where I could. Only now in this fleeting moment do I realize that i'm now tied to LastPass's ecosystem.
- ritonlajoie 13y agoIt looks like the guy having mark@facebook.com has an Adobe account !
- chengl 13y agoMany comments suggest to use password managers like lastpass, 1pass, etc. But I think that may not be a good idea: a. What if lastpass/1pass is compromised? b. You have to login to retrieve your password, which is inconvenient. I think the best solution to this is to make sure your passwords ONLY exist in your head, nowhere else. And to NOT reuse your passwords, you have to create a unique and reasonably strong one for each service. So how do I remember all these unique and strong passwords? I create an algorithm which takes two parameters as inputs: my username and the domain of the service, it will do some simple manipulation of the inputs and give me a reasonably strong password. Hence, all you need to do is to remember your algorithm and use it to compute your password when you need it. Of course, you want the algorithm simple enough to be done in your head.
- sbussard 13y agoenter your email to get pwned
- ScrawlingChaos 13y agoWeird. Flagged a hotmail addy I rarely use as having been compromised in the Adobe breach, but I don't recall ever using that address with Adobe and when I plug it into Adobe to reset the password for it, it says that they have no account associated with that address.