The Legitimisation of Have I Been Pwned

https://www.troyhunt.com/the-legitimisation-of-have-i-been-pwned/

by weinzierl • 8 years ago

277 69 8 years ago

inovica• 8 years ago

I have found this site really useful for my addresses and had set them to be alerted. Just a couple of days ago my Skype account was 'hacked' (probably because I'd stupidly used an old password and not changed it). What concerns me is just how little companies care - Microsoft have been awful at responding to it and keep pushing me to an automated system, which isn't working for me to get recovered.

kozhevnikov2• 8 years ago

I wish there was a way to prove ownership of a domain and be able to search on *@example.com for those who use unique emails for every service to track accounts that got hacked or companies that sold my personal info.

modernerd• 8 years ago

Like this? https://haveibeenpwned.com/DomainSearch

kozhevnikov2• 8 years ago

Thanks!

tialaramex• 8 years ago

So I just tried this, it's a very different proposition than normal HIBP, and much more useful to people like me who don't just have a single address and give that out everywhere.

HIBP reports that zero of my addresses have been pwned. Which is weird because those addresses include several that have been pwned in well known cases, and several more where there's no public "We had a data breach" type report but it's clear that somebody did in fact lose all my data.

That's pretty disappointing, it suggests HIBP doesn't have very much of the breach data that really matters, and so many unsophisticated users who get to the site are probably misled.

matte_black• 8 years ago

If your personal info is sold though there’s nothing really actionable you can do about it, the damage is done. Not like changing a password.

maaaats• 8 years ago

I mostly use myname+someservice@gmail.com, is it possible to search for those somehow, without listing them all?

isolli• 8 years ago

I have always been worried of entrusting Have I Been Pwned with my email address, fearing some nefarious use.

Am I being overly cautious?

robin_reala• 8 years ago

I’d say for your email that yes, you’re being overly cautious. For Troy’s recently launched https://haveibeenpwned.com/Passwords I probably wouldn’t use that myself, but he makes a reasonable case for why it’s secure.

kaoD2• 8 years ago

There's a 100% safe API for password search where you SHA1 your password and query the first 5 characters only.

Even if you don't trust that form to behave as promised, you can do the query yourself.

https://haveibeenpwned.com/API/v2#SearchingPwnedPasswordsByR...

jazoom• 8 years ago

I probably trust Troy with my passwords more than I trust myself with them.

corobo• 8 years ago

Yeah. It's an email address, not a credit card number. Don't give the site your password(s) of course, but email address I wouldn't consider something that needs keeping safe and hidden

pmarreck4• 8 years ago

Every entity you've ever emailed has your email address. As well as any entity that has hacked/compromised any one of those recipients.

Don't expect it to be even semi-secret.

feelin_googley2• 8 years ago

I have seen similar comments here before that suggest all email addresses are "public information". I am not sure I understand or agree with this perspective.

What if the address was only used to receive mail, not to send it?

nextgens3• 8 years ago

If you are looking for an "offline" way of checking your (windows) passwords against the HIBPv2 dataset, I encourage you to check my current pet project out: https://safepass.me

It's an active-directory password filter that is free for home-use and dirt-cheap otherwise.

Already__Taken• 8 years ago

Also https://jacksonvd.com/checking-for-breached-passwords-ad-usi... found in https://haveibeenpwned.com/API/Consumers offers active directry integration both offline and on.

nextgens3• 8 years ago

You're not comparing the same thing. One is a commercially supported product... that ships HIBPv2 in a ~400MB bundle, the other one a PoC... that suggests that doing a binary search over a 30GB+ dataset each time there is a password change is a sane thing to do.

https://github.com/JacksonVD/PwnedPasswordsDLL/blob/master/P...

I wouldn't recommend to anyone to seriously consider deploying that code in production!

mihaifm• 8 years ago

https://github.com/mihaifm/HIBPOfflineCheck - KeePass plugin doing the same thing

MayeulC• 8 years ago

Seeing it being recommended by government officials in multiple countries made me realize that the website isn't localized.

I think the website should be translated, together with the domain name. Actually, "pwned" already sounds like something only those who "live and breath tech", to quote the article, would be expected to be familiar with.

This unfortunately raises a serious question of trustworthiness, with regards to phishing issues. When password.com, mypassword.net and passphrase.org are valid domain, how would you know whether to trust mypassword.com?

The bandwidth costs could also be prohibitive. To alleviate this issue, I would like to see the code being opened up (for perf. improvements), and distributed hosting encouraged, databases entrusted to a few trustworthy entities, with everything sponsored by a nonprofit entity. This doesn't solve the trustworthiness of the various entities, though [unless this is done on governments'websites?].

Of course, there is always the possibility of a rogue government/ISP/hoting service MITM the connection, even issuing false certs... But a rogue actor might as well MITM the target web site directly.

stordoff2• 8 years ago

I think the website should be translated, together with the domain name. Actually, "pwned" already sounds like something only those who "live and breath tech", to quote the article, would be expected to be familiar with.

Not sure about that. I feel like translating the domain would made the phishing/trustworthiness issues more difficult - as is, there is a single canonical domain name which, at this point, has been well-publicised. Verifying that any particular translated domain for the myriad possibilities is real, especially when they may be less widely publicised/used due to having smaller userbases/fragmenting the userbase, seems tricky.

I also not sure how much of an issue "pwned" is - a lot of successful services use words that _no one_ would be familiar with or that are entirely made up.

lione• 8 years ago

Yeah, Pwned is fine. I mean what's a Google? That isn't a word!

WorldMaker• 8 years ago

I was amused by the aside late in the article that Troy has been collecting weird misspellings of pwned, mostly thanks to media articles, and buying those domains for redirects to be helpful. Personally, I'm now in love with https://haveibeenprawned.com; it's a like a little tiny modern internet reinterpretation of Kafka's Metamorphosis.

soylentcola• 8 years ago

Actually, "pwned" already sounds like something only those who "live and breath tech", to quote the article, would be expected to be familiar with.

I work in academia and a recent weekly newsletter included an article about password security and included a link to HIBP. A few hours after the newsletter came out, we received an email from a faculty member asking what it meant that he had been "pawned" because the site said he had been.

While it got a few private chuckles from us, I felt obligated to point out that outside of our circles, most people have probably never heard the techie-slang term "pwned" in their lives.

dandare• 8 years ago

This kind of service should be ultimately provided by the government as part of cunsumer protection or police services.

richmarr• 8 years ago

Which government?

kozak3• 8 years ago

If the use case is only checking YOUR OWN email address, then why not require a verification of the email before providing the results? E.g. you enter your email and get a results link sent to this same email address. Because now HIPB appears to be an interesting OSINT tool for gathering information about people, specifically for finding out what "shady" services did they ever register at.

Siecje• 8 years ago

You need to register to see the leaks from "shady" services.

kozak3• 8 years ago

Shadyness is relative. I felt quite ashamed of having an account on some of those sites that HIBP considers "non-shady".

pmarreck4• 8 years ago

One of the examples he showed was a breach of a site that used "vBulletin" as the password encryption. I looked up what the hell this was and found this: https://www.vbulletin.com/forum/forum/vbulletin-sales-and-fe...

It's basically MD5(MD5(password)+salt). It was unclear if the salt was global to the entire DB or different for every record.

Surprise, yet another case of the blind leading the blind in PHP-land.

sillysaurus3• 8 years ago

As I understand it, the problem is that many people use the same password on every forum. When they do this, an unscrupulous webmaster can use the hash to login as these members on other forums they post at. The double-hash in vB eliminates that potential issue and adds another layer of protection to forum members.

...

thrownaway9542• 8 years ago

that thread was from 2005... 13 years ago... would you like to quote something a little more recent???

pmarreck4• 8 years ago

Sure. MtGox, a PHP site, got hacked just a handful of years ago because its creator decided to write his own encryption software.

Can_Not• 8 years ago

That's from 2005, and it's one of many forum software available at that time.

There's a new release of PHP that adds several features, including a new sodium extension making PHP the first programming language to adopt modern cryptography in its standard library.

Surprise, yet another case of the blind leading the blind outside of PHP-land.

http://www.i-programmer.info/news/98-languages/11368-php-72-...

strictnein• 8 years ago

This may surprise some people, but doing stuff like MD5(MD5(password)+salt) was seen as a rather good way of storing passwords back in the day, and probably more secure than 99% of the password storage in 2005.

dest• 8 years ago

The page makes my Firefox miserably crash… (v59.0.1 stable, linux)

equationsgalore• 8 years ago

It is a great service but I really wish there was a good way of keeping it honest so we don't have to rely on trust so much. I wouldn't trust it with my passwords.

taf2• 8 years ago

I see the API and I get why charging for access would be bad but what about donations?

andimm• 8 years ago

you can donate on HIBP: https://haveibeenpwned.com/Donate

kevin_thibedeau• 8 years ago

For the sites monitoring for outside breaches of their user accounts, doesn't that indicate that they are likely keeping cleartext passwords so they can rehash them to match the hacked databases?

ballenf• 8 years ago

No, they only match against leaks where the plaintext passwords were available (either directly or due to weak hash algs).

stordoff2• 8 years ago

I'd presume that are checking passwords that leaked in plain text or with weak hashes, or potentially just matching user names and airing on the side of caution. I can't imagine most companies proactive enough to check leaked data would choose to store in plain text.

piracykills• 8 years ago

Is leakedsource actually gone?

https://leakedsource.ru seems to be up and running - or is it different people?

I mean, I sort of hate both these and prefer to just download raw data dumps straight from their source. But maybe that is legally questionable?

bogomipz• 8 years ago

I think the authors exuberance and self congratulatory sentiments seem misplaced. From the article:

"HIBP is Becoming the "Go-To" Resource for Protecting Accounts"

No "protecting" accounts" is something that is done internally at the source by companies storing user data. HIBP is offering a service that lets companies do CYA(cover your ass.) Companies can subsequently claim that they "notified" customers by telling them to check an external website. Responsibility is transferred to the customer and a third party.

"What that means for the industry is "a rising tide lifting all boats"; it's becoming more legitimate for all those doing the right thing with the data."

No, doing the right thing with data is either protecting it or not storing it in the first place. HIPB is reactionary at best. The danger is that these companies with poor to no security practices continue to make no structural changes themselves. They simply use HIPB as a crutch do the least amount of actual work to protect data. This is supported by the following statement:

"Oftentimes, the first a company knows of a data breach is when I send them their data."

It's hard to read that sentence and believe the author's assertion that "the industry has cleaned a lot/"

The Legitimisation of Have I Been Pwned

Related Stories