15 ms·

Two billion email addresses were exposed

• gausswho 10mo ago
  Amidst all of these pwnings, we still don't have a standard way to update our passwords from our password managers automatically.
  • throawayonthe 10mo ago
    if we could have standardization like that, we wouldn't need passwords
    • phoronixrly 10mo ago
      We also wouldn't be having an issue with password leaks as I expect it would be simpler to move on to passkeys (or something else) than implementing a standard way of password rotation...
      • XorNot 10mo ago
        Except passkeys are an opaque, awful solution. They're hard to explain to users, the implementations want to lock people to specific devices and phones, you can't tell someone a passkey nor type it in easily over a serial link or between two devices which don't have electronic connectivity.
        • phoronixrly 10mo ago
          [flagged]
        • NetMageSCW 10mo ago
          With the right apps, passkeys can be synced across devices (e.g. iCloud Keychain or 1Password).
  • bl4ck1e 10mo ago
    If there was a standard, do you know how long it would take to get adopted across the interwebs.
    • DANmode 10mo ago
      10 years.
  • goalieca 10mo ago
    I feel like we missed the chance to have a standard http resource for this stuff.
    • berkes 10mo ago
      yes! It's a shame, IMO, that the Basic Auth never got updated or superceded by something with a better UX and with modern security.
  • mbesto 10mo ago
    Passkeys essentially solve this, however they are not backwards compatible. If they were backwards compatible (e.g. an automated way to change passwords) then you might as well just enable Passkey as a replacement. Thats the conundrum.
  • deleted 10mo ago
    [deleted]
• worldfoodgood 10mo ago
  The downside to having many vanity urls and giving out a unique email address to each website you visit is that you cannot use haveibeenpwned without paying (despite being a single human). I have no idea how many email addresses I've given out over the years, probably hundreds across at least 6 or 7 domains, and they want to charge me a monthly fee to see which of those have been pwned. I understand they gotta make a buck, but I find it interesting this is the first real negative to running a unique email address per company/site I work with.
  • SoftTalker 10mo ago
    Just assume they have all been exposed. Email addresses are not secrets under any stretch of the meaning of that word.
    • worldfoodgood 10mo ago
      It's not the email address itself that I care about, and that's not the service that the site provides. It tells you for which email addresses a related password has been pwned.
    • deleted 10mo ago
      [deleted]
  • EvanAnderson 10mo ago
    I'm in the same boat. I track all of the unique addresses I use (via my password manager) so I guess I could just check them all against HiBP's database. Kind of a pain in the ass, though.
    • warkdarrior 10mo ago
      My password manager (Bitwarden) does that automatically.
      • EvanAnderson 10mo ago
        I use Bitwarden with a Vaultwarden server so I have some familiarity. Bitwarden checks new passwords against HiBP. I'm not aware of functionality where it can retroactively check old email addresses or passwords to see if they're included in a breach.
• joe5150 10mo ago
  It's honestly very hard to even care at that scale.
• imgabe 10mo ago
  My data was exposed in one of the Facebook leaks and it turned out I had an old email on my Facebook account with a domain I had since let lapse and abandoned. Someone else registered the domain and tried to take over my Facebook account by sending a password reset request using it. Luckily I had 2FA and I guess Facebook's fraud alerts picked it up so It wasn't successful. I guess what I want to say is beware that even something as innocuous as an email being leaked can cause problems, and make sure you delete any unused addresses from your accounts!
  • esafak 10mo ago
    What a lot of work to capture one account.
    • twodave 10mo ago
      I can think of a lot of ways that would be worth it. * blackmail the account owner * make up an illness, create a donation page and get all their friends to donate * find all connections over a certain age and disguise a phishing vector as literally anything! * so many more
      • morshu9001 10mo ago
        A real FB account with real friends who trust it (and are rich) is worth a lot
  • guywithahat 10mo ago
    Which is incredible because it means they paid to get the domain and try to access that account. I can't imagine why anyone would care that much about your Facebook (assuming you're not someone who's especially influential) and yet here we are
  • giobox 10mo ago
    One of the drawbacks of using a custom domain for personal email is you essentially have to pay for it for life, otherwise anyone can just buy your old email address if the domain expires and start receiving mail, resetting accounts... I think some folks don't fully consider this consequence when setting up a fun vanity email address or similar etc, especially now both iCloud and gmail have made it so trivial to link a custom domain.
• zwnow 10mo ago
  Can anyone enlighten me why an exposed email address is an issue? I get it if its some kinda admin@foo.com but my private mail, why would I care? Its not like they have my password?
  • dylan604 10mo ago
    Until they figure out the password to that email and then take over everything else in your life. They are not collecting email address because they are useless.
  • worldfoodgood 10mo ago
    > Oh - and 1.3 billion unique passwords, 625 million of which we'd never seen before either. It's not just email addresses. It's address + password combos. But also, how did 2 billion email addresses get exposed? Assuming I give an email address to a company (and only that company) if someone gets access to that email addresss they either got it from me or that company. Knowing the company has sold, lost, or poorly protected my email address tells me they are maybe not worth working with in the future.
    • zwnow 10mo ago
      Yea a combo is more problemtic, I could see why thats an issue. Most important stuff in my life has 2FA with my phone thankfully. My banking password got breached like 3 years ago and i still didnt change it... nothing ever happened. I am guessing tech companies that could have huge negative influence on your life should have additional security measures in place, like not allowing a login from a different country unless some kinda mobile code is provided or stuff like that. I'm pretty naive with all that tbh.
    • buzer 10mo ago
      > But also, how did 2 billion email addresses get exposed? The list contains emails which have been part of some other breaches. In my domain I have 2 emails that were exposed that weren't my normal email address. One of them was a typo that I used sign up for one service which was later breached. The other one was something someone used to register to service that I have never used & that service was later breached. Those emails have never been used for anything else as far as I'm aware. Of course judging from what posted there are likely some other services as well which were breached but wasn't noticed/published until now.
• zkmon 10mo ago
  I think we should stop seeing email address as a secret or something that can be "stolen". Password? who is still storing passwords on their servers, instead of a hash?
  • gretch 10mo ago
    Given enough time, hashes are reversible via brute force. If the attacker steals the entire password table undetected, they have a large amount of time to generate soft collisions. After all they don’t need to hack any particular account, just some 50% of the accounts. The time can be increased by some coefficient via salting, but the principles remain the same.
    • MattSteelblade 10mo ago
      For password hashing, only short-output or broken hash functions have practical collision concerns. The odds of any random collision with a 256-bit hash, and not with a specific hash, is 50% at 2^128 inputs. Salting is a defense against precomputation attacks like rainbow tables and masking password reuse. Attackers crack password dumps by trying known password combinations, previously compromised passwords, brute force up to a certain length, etc. and using the hashing algorithm to compare the output.
  • berkes 10mo ago
    A lot of companies and services are storing unsalted hashes of passwords. Which is not much better than storing plain-text passwords. It's becoming less and even languages with a "strong legacy body" like PHP have sane defaults nowadays, but I do see them around when I do consultancy or security reports. "Never fix something that aint broken" also means that after several years or a decade or more, your "back then best security practices" are now rediculously outdated and insecure. That Drupal setup from 2011 at apiv1docs.example.com could very well have unsalted hashes now. The PoC KPI dashboard that long gone freelancer built in flask 8 years ago? probably unsalted hashes. And so on.
  • elric 10mo ago
    It's not about the email addresses themselves. Those are just the identifier by which things can be discovered on haveibeenpwnd. The point is that when email addresses rae stolen/leaked, they're usually accompanied by passwords, addresses, CC information etc. In some cases the email address combined with the name of that site that leaked it can be enough to get people in trouble. E.g. "niche" dating sites.
• hirvi74 10mo ago
  I have really started to use the 'Hide my email' feature from iCloud. It's been so nice. If an email gets pwned, which often happens from a service I stopped using many moons ago, then I just deactivate or delete the email address. I imagine many other services provide this feature as well, but it's what's most convenient for me at this time.
  • rkagerer 10mo ago
    Can anyone recommend a good third party service that provides similar functionality and a great user experience? For those of us who don't want to entrust this to Apple and who'd like to use our own domain?
    • hylaride 10mo ago
      There are several options to choose from, but most data brokers will know that small custom domains go back to a certain or small group of people. That being said, this is a good list: https://www.reddit.com/r/privacy/comments/108wzvg/what_is_the_best_email_alias_service_option/ https://www.reddit.com/r/privacy/comments/108wzvg/what_is_th... Not sure I trust the longevity of some of them, though. I do use https://temp-mail.org/en/ https://temp-mail.org/en/ or other similar services for some logins for some services I'm not afraid to lose access to, though (especially for places likely to spam me).
    • sdfhbdf 10mo ago
      addy.io
• jlund-molfese 10mo ago
  Post should've been titled "1.3 billion passwords were exposed", because, even though the number is slightly smaller, it actually represents something much more important.
  • layer8 10mo ago
    The number of passwords is probably smaller. ;)
    • bobmcnamara 10mo ago
      ~1.3e9 passwords, ~1.9e9 (account, password) tuples, if I understood
      • elric 10mo ago
        The joke, presumably, was that many people share the same shitty password (e.g. 123456, password1, etc).
• naet 10mo ago
  There have been enough data breaches at this point that I'm sure all my info has been exposed multiple times (addresses, SSN, telephone number, email, etc). My email is in over a dozen breaches listed on the been pwned site. I've gotten legal letters about breaches from colleges I applied to, job boards I used, and other places that definitely have a good amount of my past personal information. And that's not even counting the "legal" big data /analytics collected from past social media, Internet browsing, and whatever else. I now use strong passwords stored in bitwarden to try to at least keep on top of that one piece. I'm sure there are unfortunately random old accounts on services I don't use anymore with compromised passwords out there. Not really sure what if anything can be done at this point. I wish my info wasn't out there but it is.
  • kccqzy 10mo ago
    Addresses? Most of the time addresses are a matter of public record. I have used https://www.fastpeoplesearch.com/ https://www.fastpeoplesearch.com/ a couple of times to search for people's addresses and it really works. One day a close friend excitedly told me she bought a new house and I told her the address before she told me about it. Telephone number? There used to be phone books. And I still instinctively think they should be public.
    • animex 10mo ago
      I think the headline is a bit vague, it includes passwords as well. Does anyone know if Troy's HIBP'd site reveals the passwords to verified users? I'd like to know if my current or what generation of passwords has been breached to evaluate if I have a current or past problem with my devices.
      • birdman3131 10mo ago
        They do not want to have such a list as it makes them a target. What they do have is a searchable password list not connected to any usernames.
        • 10mo ago
• submeta 10mo ago
  I have a throwaway email adresses for every website that requires signup. And a new password for every signup. Using Fastemail and a password manager. When emails adresses/passwords leak, I know which one I have to replace.
• hypeatei 10mo ago
  Cynicism is everywhere these days but these events really don't register for me anymore. Companies aren't punished by the government for these leaks and they aren't punished by consumers either. What incentive is there to reduce this data collection in the first place or to lock down your databases? Even if someone's security is awful as the consumer and their account gets hacked because of these leaks, what are the actual consequences of that? Oh bummer, they need to reset their password and make a few phone calls to their bank to reverse the fraudulent charges then life goes on. Techies view that as unacceptable but most don't really care.
  • morshu9001 10mo ago
    I don't care for most things, but banking is one place I've been bitten pretty hard without even getting hacked. Not going to extremes to protect it, just gonna make sure it's decent.
• eckesicle 10mo ago
  Is there any real drawback to just never giving your real name or address to service providers to minimise the chance of identity theft? Most likely it’s against terms of service, but other than account suspension are you likely to suffer any legal consequences?
  • bigbuppo 10mo ago
    The ad tech companies can associate any fake identity with your real identity. So no, there is no problem. Good thing that all ad tech companies are fully on the up-and-up and have never been compromised to spread malware.
  • Aurornis 10mo ago
    Service providers generally use your name and address to validate your billing method. If you can pay by some method that doesn’t require name or address then go ahead and use a fake name.
    • legitster 10mo ago
      Depending on the service, the billing data may be in its own database outside of the user tables.
  • rkagerer 10mo ago
    Anonimity on the Internet is going out of vogue. The only way to fix the ToS issue you raised is through regulation protecting it. Unfortunately we're going the other direction, with efforts like verified ID gaining traction in some parts of the world. It's ironic because in most cases anonymity (or allowing an alternate identity that has its own built-up reputation) would offer real protection, while the verification systems are arguably security theatre. I don't care what technical genius is built into your architecture, as soon as you force a user to plug their ID information into it, they've forked over control along with any agency to protect their own safety.
  • hn_acc1 10mo ago
    I mean, for some services, likes banks / credit cards, it's required.. For others, I try to stay anonymous / aliased where possible.
• rkagerer 10mo ago
  The bit at the end about email deliverability was also interesting: Notifying our subscribers is another problem... in terms of not ending up on a reputation naughty list or having mail throttled by the receiving server .... Not such a biggy for sending breach notices, but a major problem for people trying to sign into their dashboard who can no longer receive the email with the "magic" link. And this observation he got from someone: the strategy I've found to best work with large email delivery is to look at the average number of emails you've sent over the last 30 days each time you want to ramp up, and then increase that volume by around 50% per day until you've worked your way through the queue
  • legitster 10mo ago
    This is also known as "warming a domain" in the email world. A large rush of emails from an email server is an indicator of a hack or takeover, so anti-spam software may flag an IP address that surges in activity.
  • deleted 10mo ago
    [deleted]
• jimmar 10mo ago
  I respect Troy Hunt's work. I searched for my email address on https://haveibeenpwned.com/ https://haveibeenpwned.com/, and my email was in the latest breach data set. But the site does not give me any way to take action. haveibeenpwned knows what passwords were breached, the people who breached the data knows what passwords were breached, but there does not seem to be any way for _me_, the person affected, to know what password were breached. The takeaway message is basically, "Yeah, you're at risk. Use good password practices." There is no perfect solution. Obviously, we don't want to give everybody an easy form where you can enter an email address and see all of the password it found. But I'm not going to reset 500+ password because one of them might have been compromised. It seems like we must rely on our password managers (BitWarden, 1Password, Chrome's built-in manager, etc.) to tell us if individual passwords have been compromised.
  • junon 10mo ago
    https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
    • ekjhgkejhgk 10mo ago
      [flagged]
      • jolmg 10mo ago
        > Passwords are protected with an anonymity model, so we never see them (it's processed in the browser itself), but if you're wary, just check old ones you may suspect. That could mean one might be able to disconnect from the internet while checking.
        • ekjhgkejhgk 10mo ago
          No, it doesn't mean that, that's ridiculous. How would that work? Magic?
          • deleted 10mo ago
• jerf 10mo ago
  On the plus side, Troy can save a lot of DB space now. Instead of storing which emails have been compromised at this point he can replace that with just def email_compromised(email): return True
  • Havoc 10mo ago
    Not necessarily. Both my main addresses still come back clean after years in use. The one I use for random crap has 9 hits though.
    • Ey7NFZ3P0nzAe 10mo ago
      Same here
    • TheTxT 10mo ago
      In that case he could just store the emails that haven’t been compromised yet.
    • jerf 10mo ago
      If we're going to take my obviously unserious suggestion seriously, I'd suggest a bigger problem is that his stack isn't in Python and the code for whether an email is pwned probably isn't remotely structured as a function call like that... but other than that I'm sure it's a good idea.
• brikym 10mo ago
  It boggles my mind that most email providers don't have a way to generate aliases for sign ups. Looks like proton and fastmail support it.
• cryptoegorophy 10mo ago
  -Setup a website with article that 3 billion emails were exposed -Offer a form to check if your email was leaked -start getting confirmed emails list
  • sfilmeyer 10mo ago
    Troy Hunt has been running Have I Been Pwned for years. He even uses the k-anonymity model to allow you to search if a password has been pwned without giving him the password if you don't trust him. I get your general point, but he's been a leader in this space and walking the walk for a decade. I'm not even into security stuff or anything particularly related to this, and I still recognized his name in the OP domain.
    • kmeisthax 10mo ago
      More importantly, since HIBP sells monitoring services to 1Password, if they were maliciously collecting this data they would be immediately sued to oblivion.
• gorgoiler 10mo ago
  I’ve always had a bit of a chip on my shoulder about HIBP’s switch to charging for domain searches. It felt a bit like those travel visa scalpers who charge 50 CURRENCY_UNIT to file an otherwise gratis form on your behalf. Law enforcement should provide this kind of service as a public good. They don’t, but if you do instead, I don’t think it’s cool to unilaterally privatize the service and turn it into a commercial one. I voted with my feet but this post feels like a good enough place to soapbox a bit!
  • NetMageSCW 10mo ago
    How much did you donate to keep HIBP running? What is the URL to your free HIBP alternative?
• debugnik 10mo ago
  > However, none of the other passwords associated with my address were familiar. Could at least some of those cracked passwords be hash collisions for really weak choices of hash? I once looked up an email of mine on a database leak, and found an actual outdated password except for random typos that I suspect hashed the same.
• ptrl600 10mo ago
  Are there any email services which allow basically unlimited aliases with long, random names? I'm using my own domain right now, but that can only uncover who has leaked my data; does not provide additional privacy.
  • mac-attack 10mo ago
    duckduckgo's free email aliases. Can use it as a front-end and keep your existing domain
    • ptrl600 10mo ago
      I misphrased my query; I already run my own mail server and am using a unique e-mail address for every service. I'm wondering if there's a provider with a common domain name shared between lots of users that still allows such a large number of aliases. That would let me use a fake name for anything that doesn't need my real identity, and wouldn't reveal my identity in the case of a breach. Has any e-mail provider found a way to implement this while preventing abuse?
  • bootlooped 10mo ago
    I know you can set up "catch-all" email with a custom domain through Proton Mail. I don't think there's any limit on gmail + codes.
  • gostsamo 10mo ago
    check simple login. they were both by Proton, but you can use them without the parent.
  • mapper32 10mo ago
    https://simplelogin.io/ https://simplelogin.io/
  • mkl 10mo ago
    Use a catch-all inbox. Fastmail supports them well in its web interface. I use unique addresses for every organisation.
• gostsamo 10mo ago
  I checked a few of my passwords and a few random ideas. It turns out that I'm not the only one who finds the Star wars drone names a good inspiration for a password, but the rest were okay. Proud that I found a password which leaked in only one breech. Whoever has used "feromancer" as a pass, congrats, you might be unique among a big part of humanity.
• sloped 10mo ago
  I switched to using masked emails with Fastmail primarily so I could see who sold my data. The potential security benefit was not really a driver. Having 1Password be able to generate a unique email makes it a no-brainer these days. For those services that require a username that is not your email, they can usually be used without the domain part. Works really well. I even wrote a tiny little local only web app that I can use to generate a masked email on my phone, so when I need an email for an in person thing I can just show them my brand new weird email directly on my phone.
  • digiconfucius 10mo ago
    Any interesting finds on companies that tried to sell your data?
    • sloped 10mo ago
      Not really any places where things get sold, but opt-in in the background for newsletters is bad in certain sectors. Ticket platforms are terrible. I like to use a new email for every event and boy does that lead to new round of clicking opt-out until I can deactivate the email after the event has concluded.
  • frankdvn 10mo ago
    I just learned that FastMail provides an iOS shortcut to "Create Masked Email". Just be careful, you must press Save after or else you'll lose it.
• layer8 10mo ago
  Interestingly, the HIBP data seems to have an expiration date. My email address from the Dropbox data breach [0] is now shown as having no recorded breaches, although it did back in 2016 after HIBP acquired that dataset. [0] https://haveibeenpwned.com/breach/Dropbox https://haveibeenpwned.com/breach/Dropbox
  • reddalo 10mo ago
    Are you sure you typed the right email address? My 2012 Dropbox leak still shows up for my account.
    • layer8 10mo ago
      Yes, I’m sure. The old password from that breach also doesn’t show any hits.
• zahlman 10mo ago
  From what HIBP tells me (from an email address; I am not about to put any site's password in there, I don't care that they don't know who I am or what it's for): > During 2025, the threat-intelligence firm Synthient aggregated 2 billion unique email addresses disclosed in credential-stuffing lists found across multiple malicious internet sources. Comprised of email addresses and passwords from previous data breaches, these lists are used by attackers to compromise other, unrelated accounts of victims who have reused their passwords. The data also included 1.3 billion unique passwords, which are now searchable in Pwned Passwords. (Edit: this is also directly linked in TFA. Well, I guess the site was still somewhat successfully advertised here...) So, this doesn't seem to comprise new information, and doesn't imply that your email has been associated with your password by the hackers. Although they probably do have passwords for a couple of services I don't use any more, which I have not reused.
• elwebmaster 10mo ago
  Why are we still using passwords? Why can’t all login be done with asymmetric keys: your public keys are stored on the server, your private keys on the device. Carry a backup pair on your USB and treat it as a key to your house. Any of them got lost? Just delete the respective public key from the service.
  • magackame 10mo ago
    That's passkeys. Google and Microsoft are pushing in that direction.
    • elwebmaster 10mo ago
      I have never seen a website where I can sign up without a password and using only email and passkey. Is there one? All websites treat passkeys as an “add-on” to the passwords of the last century. Totally backwards thinking.
  • mrweasel 10mo ago
    How are you going to sign in and delete the public key, if you lost the private key? This is exactly why so many do not want passkey, the recovery options aren't exactly great.
  • deleted 10mo ago
    [deleted]
• layer8 10mo ago
  Amusingly, hunter2 is listed with over 50.000 breaches.
• waynesonfire 10mo ago
  Another ad for have i been owned? ... How much does it cost to advertise on hackernews?
• galaxyLogic 10mo ago
  What about "pass-codes"? Weren't they supposed replace passwords?
• anonu 10mo ago
  > we run on Azure SQL Hyperscale, which we maxed out at 80 cores for almost two weeks the data challenge is interesting here. there's clearly a lot of data - but really its just emails and passwords you need to keep track of. SQL feels like overkill that will be too slow and cost you too much. are there better solutions? 15 billion records of email+password, assume ~40bytes thats roughly 600GB should be searchable with a an off-the-shelf server. of course, im oversimplifying the problem. but I'm not clear why any solution to insert new records would take 2 weeks...
  • jiggawatts 10mo ago
    > we run on Azure SQL Hyperscale Definitely the wrong technology, and was almost certainly picked only because Troy Hunt is a "Microsoft Regional Director and MVP". Many other technologies scale better for this kind of workload. Heck, you could ask ChatGPT to write a short C# CLI tool to process the data on one machine, you don't even need a huge box. This kind of thing comes up here regularly on HN for problems such as duplicate password detection, leaked password filtering, etc... After previous brainstorming sessions the general consensus was that it's really hard to beat a binary file that contains the sorted SHA hashes. I.e.: if you have 1 billion records to search and you're using a 20-byte SHA1 hash, then create a file that is exactly 20 billion bytes in size. Lookup is (naively) just binary search, but you can do even better by guessing where in the file a hash is likely to be by utilising the essentially perfectly random distribution of hashes. I.e.: a hash with a first byte value of "25" is almost certainly going to be 10% of the way into the file, etc... It's possible to create a small (~1 MB) lookup table that can guarantee lookups into the main file with only one I/O operation of a fixed size, such as 64 KB. Sorting the data is a tiny bit fiddly, because it won't fit into memory for any reasonably interesting data size. There's tricks to this, such as splitting the data into 65,536 chunks based on the first two bytes, then sorting the chunks using a very ordinary array sort function from the standard library. On blob storage this is super cheap to implement and host, about 50x cheaper than Azure SQL Hyperscale, even if it is scaled down to the minimum CPU count.
    • zazaulola 10mo ago
      Try Blake3 instead SHA-1 https://github.com/BLAKE3-team/BLAKE3 https://github.com/BLAKE3-team/BLAKE3
• jorams 10mo ago
  This seems to include details from a Spotify data breach in or before early 2020 that, to my knowledge, was never reported on. They did have other, similar issues that year. Reporting from the time seems to all be about one or multiple leaks/attacks involving: - Credential stuffing with data from other breaches - A leak of data (including email addresses) to "certain business partners" between April 9, 2020 and November 12, 2020. On April 2, 2020 somebody logged in to my Spotify account (which had a very weak password) from a US IP address. This account used an email address only ever used to sign up to Spotify years earlier, and the account had been unused for years by that point. I changed the password minutes later. A few hours after that Spotify also sent an automatic password reset because of "suspicious activity". At no point have I ever been notified by Spotify that my data had been leaked, though it obviously had, and now said email finally shows up on HIBP.
  • Torn 10mo ago
    You'd think spotify as a mature company would have had obligations to report this stuff!
  • deleted 10mo ago
    [deleted]
• ChrisMarshallNY 10mo ago
  I think, at this point, we should just assume that our emails are out there. Can't put the candy back in the piñata. My main email addy is an OG mac.com address. I registered it about five minutes after Steve announced it. My wife got her first name, but I suspect that Chris Espinosa already had chris@mac.com. In any case, it was compromised back when Network Solutions sold their database to spammers (or some other scumbags sold their database), and it's been feral, ever since. Basically, most of this century. I've survived it. I maintain Inbox Zero, frequently. One of the saving graces, is that mac.com has "aged out," so most of the spammers switched over to icloud.com, and that means I can just set up a rule to bin anything that comes into icloud.com.
• 1970-01-01 10mo ago
  Giving out fake information is the only solution. Real name is only for the government and your employer.
• 1a527dd5 10mo ago
  This explains why my outlook/hotmail account had a 2fa prompt from a country I've never been in a few days ago. Checked my password on https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords :- This password has been seen 1 times before in data breaches! _Great_.
• Retr0id 10mo ago
  The scale of infostealer malware is really staggering. I'd have naively assumed that OSes were getting locked down so much by default these days that local malware was less of an issue.
• hk1337 10mo ago
  I'm guessing this is total, not an alert that something happened last night that exposed 2 billion email addresses.
• jacquesm 10mo ago
  I totally respect Troy and the work he's doing, but I still can't justify to myself the risk of typing my passwords into his website because that would be the very first time that I would use any of those in places other than the ones where I normally use them. Is there a way around this? Edit: to answer my own question, I should read a bit more rather than click on the first link, the answer is here: https://haveibeenpwned.com/API/v3?ref=troyhunt.com#PwnedPasswords https://haveibeenpwned.com/API/v3?ref=troyhunt.com#PwnedPass... Which uses: https://en.wikipedia.org/wiki/K-anonymity https://en.wikipedia.org/wiki/K-anonymity
  • arealaccount 10mo ago
    DM me your passwords Ill do it for you
• mbana 10mo ago
  Do some research on passwords, in particular read Bruce Schneier's stance on passwords.
• senorqa 10mo ago
  If there's no meaningful reward or punishment for keeping or leaking PII, companies won't do anything about it. They'll keep collecting sensitive inf unless they're educated or forced not to collect unnecessary PII.
  • tencentshill 10mo ago
    We need to make storing customer data and recommendation algorithms a liability.
  • adabyron 10mo ago
    Not just this but the lack of diligence by companies that allow accounts to be created, bills to go unpaid & then sent to collection agencies is something that needs to change. Speaking as someone who has had companies give away my PII and then other companies open accounts with it without contacting me until bills are due. None of this should be the fault of innocent individuals.
• yawgmoth 10mo ago
  When you have days like this, 2-10 billion and you want to search it, what are the cheapest options? Reindexing could be slow, be search should be reasonably quick. It would be really expensive to do this all in, say, Elastic, right? Especially if you had a bunch of columns?
• 8cvor6j844qw_d6 10mo ago
  Anyone have thoughts on Bitwarden / 1Password / Proton Pass? Proton Pass feels too new for me but eagerly awaiting good feedbacks / reviews. However, "don't put all your eggs in one basket" might apply here. Went with Bitwarden instead of 1Password since its open source, and I imagine (in my uninformed opinion) that a larger userbase by being free means more issues might be encountered and ironed out.
  • LilBytes 10mo ago
    1Password is awesome. I haven't really looked at anything else but I found >2 years ago the UI of BitWarden to be ordinary. And it was more awkward to manage a company. Went with 1Password in the end, and that you get a free Family account with a Business account is great. Your position on how BitWarden is open source should contribute to any decision you make though.
    • frm88 10mo ago
      I switched from Windows to Linux a couple of weeks ago and to KeePass XC. I like it that I can easily copy/paste passwords on sites where autofill is not allowed, e.g. banking. It's free, open source, no tracking and local and you can donate directly to the org. Of late I grow somewhat allergic to commercial solutions.
  • txtsd 10mo ago
    I suggest KeepassXC + SyncThing + KeepassDX (for Android)
  • mrweasel 10mo ago
    If you're happy with Bitwarden, I think you should stick to that. I'm currently using 1Password, I switches after the security issues with Lastpass. Later I did try Bitwarden but was unhappy with the ability to correctly identify username and password fields on websites. Others tell me that they have more a better experience with Bitwarden, so I might have to give it a try again. 1Password is really nice, but it's also expensive, compared to Bitwarden.
• vineet_joseph 10mo ago
  [dead]
• lisbbb 10mo ago
  I'm sorry, but I couldn't really follow what the hell that guy was writing. So some huge number of emails and passwords got exposed somehow?
• Springtime 10mo ago
  This is a massive PITA for any users who exclusively use unique passwords and various unique addresses, as it sounds like the source of the breach(es) is unknown (so hard to judge which accounts would be affected without using Troy's sites to test everything or find some searchable dump online somewhere dubious).
  • NetMageSCW 10mo ago
    Just check each unique password and then you know which sites need a password change?
    • Springtime 10mo ago
      That would be hundreds to check. While for the quoted users in the article all but one seems to have reused their password(s), suggesting fewer used overall so easier to check.
• dmje 10mo ago
  I’m unclear how the new data helps anyone? If you identify you’ve been in a data breach with Adobe for instance, you change your Adobe password. But if you’re in this new dataset there’s no service being pointed at - just “you’ve been breached” which doesn’t really help anyone apart from those who have the same pwd for everything. Maybe they’re the audience, I’m unclear.
  • pacificmint 10mo ago
    I agree. I wish it would tell me the password, there is a good chance I could identify the service that it came from based on the password. This way it doesn’t feel that useful.
• hufdr 10mo ago
  I feel like my phone number and email have already been leaked a long time ago. These days I get spam emails almost every day, and random calls from different cities keep coming in. What I keep wondering is how all this data gets out there. Is there an entire underground business built around selling our information?
  • seb1204 10mo ago
    Yes, unfortunately there is a whole industry out there after your data.
• fencepost 10mo ago
  I was mildly annoyed by the handling of this for domains. I have a personal domain, and now I know that one of the generally service-specific email addresses I've used (most likely with a unique password unless it's Palm levels of old) has been breached with its password. I don't know which one because I don't have a high enough (paid) account. If I'd realized that jumping through the hoops to get onto the site was just going to tell me I'd need a paid account I'd have saved myself a few minutes. As it was it made the whole experience feel like I fell for a sales email.
  • saintamh 10mo ago
    Domain search is free. I never paid for HIBP and they give me a list of every address @my-domain that’s been leaked. Edit: others are pointing out that it’s only free for domains with fewer than 10 pwned addresses. I have 8.
    • fencepost 10mo ago
      The message I got wasn't related to the number of addresses affected (though I've been using this approach for a couple decades), but IIRC regarded whether the datasets in question were free.
• mrweasel 10mo ago
  This is exactly while I and incredibly reluctant to sign up for any new service. You have to offer me something very special for me to ever create an account with your site. A free trial simply isn't enough for me to wanting to deal with yet another account, and I have a password manager. Sign in with Google/Apple/Facebook/Microsoft/Github, whatever, could have been a solution, but I don't believe any of them to trustworthy long term.
• voidUpdate 10mo ago
  Ah, so that's why I've been receiving emails about suspicious attempted logins...
• jonathanstrange 10mo ago
  I don't understand "email leaks." My email has and always will be public, that's the whole point of having an email address. It's on my website so people can contact me.
• w4lker 10mo ago
  I have several doubts about the utility of haveibeenpwned. For example, I know for a fact that a certain email of mine have been exposed, but it never appears on the site.
• sherinjosephroy 10mo ago
  [dead]
• WhereIsTheTruth 10mo ago
  This website is very useful, you can target any individuals and find all their secrets (websites they browse, their data and passwords) More seriously, they should notify the owner of the email address privately rather than displaying it publicly, this can be easily weaponized But who cares right, they are monetizing the service..
  • NetMageSCW 10mo ago
    None of that is true, but you keep your outrage going.
    • WhereIsTheTruth 10mo ago
      If that makes you sleep better at night, you are free to believe none of that is true and just move on..
• donatj 10mo ago
  Many people here have echoed similar sentiments, but I really wish they would give you any sort of information so you could have any sort of idea of what got pwned and ideally when. Was it a bank account, or some random forum? As it stands the action of even processing this data was of very little utility. As with roughly a quarter of the planet, I was in this breach. My 1Password Watchtower is green. I cycle important passwords regularly. Back 10-15 years ago my passwords like most peoples were much shorter and not randomly generated. All of them for everything show up in the passwords search. The utility of Have I Been Pwned approaches zero the longer you have been on the internet, and I have been on the internet since the late 1990s. We're left in a place where everyone but the victim knows the compromised account, and that's just kind of absurdly useless.
  • jve 10mo ago
    > The utility of Have I Been Pwned approaches zero the longer you have been on the internet, and I have been on the internet since the late 1990s. I mean if your 1Password is green then HIBP has definitely helped. First of all, without HIBP, you wouldn't have Watchtower. HIBP has raised awareness on having unique passwords per site. HIBP has achieved that multiple services now can and check if particular password is leaked or not. Of course you could argue that since your security hygiene is so good you don't need HIBP. True. Let's pretend every people on planet will be generating unique passwords per service. Great. HIBP will have achieved enourmous job of making the planet more secure. And still a notification if you appear in some breach that can be attributed to a service - good signal to change password. Hats off for you cycling the password.. Have you ever ran into problems with that? Say you kinda rotated password but it no longer is accepted or something?
• TabTwo 10mo ago
  Got 10 hits. 8 of the email adressess were invalid like user1@ and user2@ while user@ would be the valid one
• L_226 10mo ago
  Is Troy rotating out old breaches? Because I have 2 email addresses that were definitely part of leaks (I got notified by the parties that were hacked), and one of them used to show up as compromised on the site, but no longer. The other one was part of the Qantas frequent flyer leak (I got an email from Qantas about it), but this address doesn't show up as part of that leak.
• mdale 10mo ago
  Almost like it's irresponsible to not require 2 factor now days.
• dangerboysteve 10mo ago
  Is it me, or is anyone just numb to all these breach articles? I take all the precautions, use 2FA everywhere, stay away from sketchy sites, use ad/malware blocker and the issue is always never the individual. It's usually the website/app and their lack of security, not keeping up with patching or sloppy programming.
• bookofjoe 10mo ago
  As a complete non-techie reading hundreds of comments on this it strikes me that there are a pretty much unlimited number of solutions/methods employed and described by HN readers — which makes me conclude none of them is THE best answer. It's like we say in medicine: the fact that there are 100 remedies for hiccups means none of them usually work.
• timvisee 10mo ago
  The email I have in that list is invalid and must be generated. It's on a domain I own.
• deleted 10mo ago
  [deleted]
• 1vuio0pswjnm7 10mo ago
  As used here, the term "preventative" means an approach or strategy that seeks to prevent email addresses from becoming public and term "remedial" means an approach or strategy that seeks to limit damage if email addresses become public To reduce risk from data breaches one option is to send less personal data to websites rather than more (preventative) One old strategy is to not "sign up" for websites unless absolutely necessary (preventative), e.g., to complete a commercial transaction. On the early www, sites publishing public information generally did not ask for email addresses Another old strategy is to use account-specific addresses and account-specific passwords that identify the account, the date and the computer used, i.e., some user-contructed identifier only known to the computer user (remedial) Alas today's website operators, including ones offering nothing more than public information, attempt to convince visitors to "sign up" and submit email addresses, even when it is not necessary to access the public information The website operators benefit from this data collection As such, data collectors may not recommend that users stop signing up for websites and sending email addresses (preventative). It would reduce their benefit. Instead, they encourage it HIBP is one such data collector. It requests email addresses in order to search public information HIBP focuses on behavioural trends with respect to passwords (remedial) instead of behavioural trends in sharing personal data with website operators (preventative) The operator even admits having an interest in password managers "My interest in 1Password aside" Data breaches share private information with the public, making it, detrimentally,^1 public information. This is how it becomes accessible to HIBP An obvious mitigation strategy is to limit the amount of private information collected (preventative), thereby limiting the amount that could ever be shared with the public in a data breach. This is "preventative" HIBP is "remedial", i.e., it assumes private information has become public. Without data breaches to collect and search, HIBP would not exist The two approaches, preventative and remedial, are not mutually exclusive Both can be used at the same time (preventative plus remedial) HIBP appears to ignore the preventative approach of modifying behaviour to not submit email addresses to websites. Perhaps because HIBP itself engages in data collection. It solicits email addresses Unfortunately, one cannot use an account-specific address with HIBP. It solicits addresses that have potentially been used for other accounts 1. Arguably breaches are not detrimental for HIBP since it profits from their existence. If there were a reduction in data breaches, could HIBP continue to successfully solicit more email addresses. If there were behavioural changes the resulted in www users creating fewer accounts and sharing fewer email addresses, would demand for password managers suuch as 1Password be reduced
• mgpalmer 10mo ago
  Great work by the HIBP team as usual but I am puzzled by something, maybe someone can shed light on it? I'm managing a domain search dashboard for a company, and for one domain all the recent stealer log breaches contained addresses with the domain - but all the local/user parts were bogus - for example, fabuchoy@example.org where fabuchoy was never a user, the email never existed. So nothing is in danger but where do these bogus addresses come from? Is someone just trying to log in somewhere with random addresses (with our domain) and then the (failed) login attempt gets sniffed by some malware and ends up in the breach dumps? Or are the cybercriminals just padding their dumps with made-up addresses?