Also started migrating old accounts in free time.

Now its pretty easy to tell the source of leak by email addresses as well as sources of spam.

---

Per-account alias might sound much, but using sieve filtering [1] is amazing, and you can get a comprehensive filtering solution going with 'envelope to' (the actual address receiving the email) + 'header to' (the recipient address you see, sometimes filtering rules don't filter for BCC or sometimes recipients are alias instead of your actual email) that are more comprehensive than normal filtering rules to sort your emails into folders.

[1]: https://datatracker.ietf.org/doc/html/rfc5228

---

Amusingly, I've managed to recover old accounts from emails that contains my old passwords with demands for crypto payment, it just provided me enough help to recall old variations of my passwords.

Telephone number? There used to be phone books. And I still instinctively think they should be public.

I'm in a similar situation, just make sure your credit is frozen with the 3 major US companies. I had someone steal like $50 of cable TV with my info in another state and it was a major pain to get off of my credit report.

It was leaked through no fault of my own. There are 0 actual consequences to companies doing it. So what am I going to do - stew about it??

As per my understanding the only possible threat it saves against is someone trying to brute force for your password against the application. And may be ease the cognitive burden of remembering different passwords.

The government can have at my real info, but private companies have bad data security.

Does anyone still care?

I like how the Apple Password app informs you about Compromised Passwords so you can you know... go in and fix it, get a new password etc.

Nice little cute idea.

I got 717 warnings. Seven hundred seven teen.

No I will never be able to fix this

There's a guy who lives near me who, when he parks his car, very carefully puts tape over the number plate "because otherwise people might see my registration number". Because apparently if people can see your car's registration number they can somehow just steal your car and the police won't do anything because the number plate was visible. Mad, absolutely barking mad.

For example a forum might leak a map between your mail and a password; Implicitly your affinity for that forum's topic is also now on the public record, additionally if your posts were public but under a pseudonym, that might be now known by a sufficiently motivated attacker.

Finally this may be linked with other public datasources like your public tweets or public state records, or even other leaks.

This is why the meme about all ssn's being leaked or about a list of all valid phone numbers is so asinine.

The one I use for random crap has 9 hits though.

For ID fraud, more than an email address has to be leaked.

[1]: https://www.troyhunt.com/welcome-to-the-new-have-i-been-pwne...

Email addresses are not secrets under any stretch of the meaning of that word.

So cost was always part of this strategy

You should be using a unique randomly-generated password for each website. That way, one breach doesn't lead to multiple accounts getting hijacked AND you'll know which passwords were breached solely based on the website list. The only passwords I still keep in my head are:

  1. The password to my password manager
  2. The password to my gmail account
  3. The passwords for my full disk encryption

I used to reuse the same password for everything, and that lead to a pretty miserable month where suddenly ALL of my accounts were compromised. I'd log in to one account and see pizzas I never ordered. Then I'd open uber and see a ride actively in-progress on the other side of the country. It was not fun.

Yes.

If it has, it is either a simple password that multiple people are using, or a complex secure password that can make you pretty confident it is your password that has been published.

1Password just does the same thing for all of your passwords - it doesn’t check against your account name either. That information isn’t stored so they can’t become a new source of breached accounts (as explained at the site).

It gives you as much information as you should be given. Any more information would just be spreading around the hacked dataset.

It does give you an awful lot of information about the specific hacks that exposed your information, and what was the content of that exposure. You may have been owned, but the way you were owned doesn't really matter e.g. I don't care that my firstname.lastname@gmail.com was exposed as being me. I may not care that my username@yahoo.com account was exposed as being username at archive.org. If that's it, I can keep using them. But a lot of hacks are a lot worse, and you might have to rearrange things or close them down. haveibeenpwned gives you enough information to make all those decisions.

Also, your second paragraph seems to imply that the site doesn't tell you if passwords were compromised for an email address. It definitely does by identifying the hack and describing its extent. You don't need the actual password to know that you need to change it. Likely, the hacked site forced you to change it anyway.

I've got over 200 users in a domain search (edit: for this particular incident), and nearly all of them were in previous credential breaches that were probably stuffed into this one. I'm not going to put them through a forced annoyance given how likely it is the breached password is not their current one, and I'm urging people to start moving in this direction unless you obtain a more concrete piece of advice.

> The websites the stealer logs were captured against are searchable via the HIBP dashboard.

There is no way to use the HIBP dashboard to figure out what domains my email address appears against.

Am I meant to change all passwords associated with that email address? Or do I need to get a paid subscription to query the API to figure out exactly what password(s) to change?

This has always confused me. On the one hand, HIBP is an invaluable service, but, on the other, it does nothing more than stating you’re in trouble, with no clear way forward.

I know roughly what passwords were exposed because either I remember it, or the date of the leak or the associated email.

I know simple passwords are almost public and that leaks of say linkedin will be properly hashed, while a vb forum from 2006 might not be.

I mean if your 1Password is green then HIBP has definitely helped.

First of all, without HIBP, you wouldn't have Watchtower.

HIBP has raised awareness on having unique passwords per site.

HIBP has achieved that multiple services now can and check if particular password is leaked or not.

Of course you could argue that since your security hygiene is so good you don't need HIBP. True. Let's pretend every people on planet will be generating unique passwords per service. Great. HIBP will have achieved enourmous job of making the planet more secure.

And still a notification if you appear in some breach that can be attributed to a service - good signal to change password.

Hats off for you cycling the password.. Have you ever ran into problems with that? Say you kinda rotated password but it no longer is accepted or something?

Speaking as someone who has had companies give away my PII and then other companies open accounts with it without contacting me until bills are due.

None of this should be the fault of innocent individuals.

Definitely the wrong technology, and was almost certainly picked only because Troy Hunt is a "Microsoft Regional Director and MVP".

Many other technologies scale better for this kind of workload. Heck, you could ask ChatGPT to write a short C# CLI tool to process the data on one machine, you don't even need a huge box.

This kind of thing comes up here regularly on HN for problems such as duplicate password detection, leaked password filtering, etc...

After previous brainstorming sessions the general consensus was that it's really hard to beat a binary file that contains the sorted SHA hashes. I.e.: if you have 1 billion records to search and you're using a 20-byte SHA1 hash, then create a file that is exactly 20 billion bytes in size. Lookup is (naively) just binary search, but you can do even better by guessing where in the file a hash is likely to be by utilising the essentially perfectly random distribution of hashes. I.e.: a hash with a first byte value of "25" is almost certainly going to be 10% of the way into the file, etc...

It's possible to create a small (~1 MB) lookup table that can guarantee lookups into the main file with only one I/O operation of a fixed size, such as 64 KB.

Sorting the data is a tiny bit fiddly, because it won't fit into memory for any reasonably interesting data size. There's tricks to this, such as splitting the data into 65,536 chunks based on the first two bytes, then sorting the chunks using a very ordinary array sort function from the standard library.

On blob storage this is super cheap to implement and host, about 50x cheaper than Azure SQL Hyperscale, even if it is scaled down to the minimum CPU count.

The article mentions some of the challenges, like 1.9e9 sha1 hashes. And 1.9e9 row updates performing poorly in-place, so they created a separate table for the results. Then they got rate limited by email providers when they wanted to tell people about their pwnage

Edit: others are pointing out that it’s only free for domains with fewer than 10 pwned addresses. I have 8.

My 2012 Dropbox leak still shows up for my account.

For those of us who don't want to entrust this to Apple and who'd like to use our own domain?

It's not just email addresses. It's address + password combos.

But also, how did 2 billion email addresses get exposed? Assuming I give an email address to a company (and only that company) if someone gets access to that email addresss they either got it from me or that company. Knowing the company has sold, lost, or poorly protected my email address tells me they are maybe not worth working with in the future.

Just be careful, you must press Save after or else you'll lose it.

It's becoming less and even languages with a "strong legacy body" like PHP have sane defaults nowadays, but I do see them around when I do consultancy or security reports.

"Never fix something that aint broken" also means that after several years or a decade or more, your "back then best security practices" are now rediculously outdated and insecure. That Drupal setup from 2011 at apiv1docs.example.com could very well have unsalted hashes now. The PoC KPI dashboard that long gone freelancer built in flask 8 years ago? probably unsalted hashes. And so on.

If the attacker steals the entire password table undetected, they have a large amount of time to generate soft collisions. After all they don’t need to hack any particular account, just some 50% of the accounts.

The time can be increased by some coefficient via salting, but the principles remain the same.

In some cases the email address combined with the name of that site that leaked it can be enough to get people in trouble. E.g. "niche" dating sites.

1Password is really nice, but it's also expensive, compared to Bitwarden.

I haven't really looked at anything else but I found >2 years ago the UI of BitWarden to be ordinary. And it was more awkward to manage a company.

Went with 1Password in the end, and that you get a free Family account with a Business account is great.

Your position on how BitWarden is open source should contribute to any decision you make though.

I use it with Vault/Bitwarden, which lets me generate email addresses of format `<uuid>@my.domain.com` when I create new login info for services.

I don't think there's any limit on gmail + codes.

What is the URL to your free HIBP alternative?

This is exactly why so many do not want passkey, the recovery options aren't exactly great.

The only way to fix the ToS issue you raised is through regulation protecting it.

Unfortunately we're going the other direction, with efforts like verified ID gaining traction in some parts of the world.

It's ironic because in most cases anonymity (or allowing an alternate identity that has its own built-up reputation) would offer real protection, while the verification systems are arguably security theatre.

I don't care what technical genius is built into your architecture, as soon as you force a user to plug their ID information into it, they've forked over control along with any agency to protect their own safety.

If you can pay by some method that doesn’t require name or address then go ahead and use a fake name.

For others, I try to stay anonymous / aliased where possible.

I get your general point, but he's been a leader in this space and walking the walk for a decade. I'm not even into security stuff or anything particularly related to this, and I still recognized his name in the OP domain.