“Help, help, my account is listed on haveibeenpwned!”, said no-one, too embarrassed to speak up.

I wonder just how many people tell others when they appear on that site.

It must be quite the conundrum to announce that your account was up there (and a call to get hammered by people’s questions if you use KeePass or not).

Just a reminder and not a hammering: please use a password manager that automatically generates passwords and saves them encrypted on your drive.

If you used it and you’re on havibeenpwned, your password you lost wouldn’t’ve mattered! It would have leaked something that looks like NI)EWh032gvh2t804*)#GTFew and nobody would have even thought twice.

My first thought when visiting that site was, “Do I really want to give my eMail address to someone on the other end of this?”

I didn’t. Knowing wouldn’t have changed my already thoughtful password management strategy.

-Noel

I agree with Noel Carboni. I’m loathe to give my email adress to anyone, company or website.

Agree with Neal…thought the same thing when the site came out years ago….save this fellow is quite well known, and trusted by Krebs and others in his arena. The FAQ looks pretty tight, but the founder is Troy Hunt, a Microsoft Regional Director.

You have his word that nothing is retained on his site; but there are all sorts of attacks that could go down with “man in the middle”…

And password managers? What if your only PC goes down, and takes that with it?  Backups, of course, but resetting everything including routers, etc can be a real pain in that scenario, if you are lucky enough to have another machine.

No, I use very basic, but effective methods for passwords, which I will only infer here, and give Douglas Adams credit:

Written down in a Sumerian script, in the 3rd sub cellar of three different locations, in the janitor’s closet behind a door marked “Beware The Leopard.”

For coming up with them, or actually writing them down, obscure foreign languages that use script other than Roman are very useful too. How’s your Thai or Javanese?

Code cyphers for further password obfuscation are great too. So many to choose from! 😉

And never, never use the same PWD twice.

Ouija Boards, anyone?

haveibeenpwned has listed my email as being compromised in relation to yahoo, ever since that famous yahoo breach. Thing is, I have never done anything yahoo related beyond mentioning it here. Maybe yahoo handled posting on a website I made a comment on at some point, but no matter what I do I can’t get yahoo to send me an email to reset the password. IIRC, yahoo deleted everyone’s passwords after (they announced) the breach, so it’s pretty much a moot point.

I’m not worried about it, all my passwords are long strings of gibberish, all different for each site.

@m8urnett‘s work is behind a great password-strength testing site, which really does bust some complacency about passwords.
It’s worth checking this out:
https://howsecureismypassword.net/

Recently Brian Krebs has had several stories about how phishing emails have been sent with old passwords being used in the email to frighten you into thinking the attackers had some information about you.

The joke’s on them, then, as I’ve never seen 99% of my passwords!

If I was concerned about my email addresses being compromised, the last thing I’d do is enter them all on a site expressly designed to collect email addresses, no matter who was running the site and how trustworthy they may be – the sites any email addresses were compromised on in the first place are likely to have been run by equally eminent and trustworthy companies/people.

I did check haveibeenpwned — an old email came up from Linkedin.  All my current emails came up clean.  I am very paranoid but somehow felt comfortable giving my email address to haveibeen pwned because email addresses are “out there” anyway (e.g. one person sending a joke without bcc is enough to make my head spin).  I have five email addresses for different purposes (bank alerts, shopping, personal email, throw away, etc.)  Since they are all gmail accounts I can easily delete them and start fresh.  Even my personal email address has so few people in the address book that I can notify folks that I have changed my email address .  Yes, this is embarrassing to do but I have done it twice already for security reasons.

As for my passwords, I don’t trust password managers and only use one desktop at home so I have a little book with all my passwords written in it (I only have the five passwords for the email accounts, the IMac password, and just a few others – probably only ten in all.  They are random and long with some caps some numbers some symbols, etc. and I change them from time to time.  (When I got my IMac a few months ago I had a computer man come to install it and he had never seen anyone go through typing the kind of passwords that I had — between my getting used to the feel of the magic keyboard and the length and complexity of my passwords — let’s just say he was here for quite awhile and he has not forgotten me!)

I would not send my password into a website to find out if it was pawned.

I have a Yubico key that I use for the gmail accounts and use two factor authentification wherever it is available.

Ttthat’s All Folks!

I thought the same as you guys regarding giving away an email address, but out of curiosity…

I tried it with a few email addresses of people I know and one old of mine which I knew were already in spamming databases. It came up with interesting results. Mostly, they were found stolen in places where there was data breaches like an antivirus forum, Myspace (not mine) or other similar places where you had to register to post a question that I used once or twice.

To me, this is just a good reminder to never use the same password on different sites, even if you think those web sites are not really important to you. The information that could be gathered from different sites could sometimes be used against you on other more important services.

I have been using HaveIBeenPwned for around two years. HaveIBeenPwned is a completely legitimate web site which was created by Troy Hunt who is a Microsoft Regional Director. Here is a fairly interesting 2015 Forbes article about how a Forbes staff writer and Troy verified that 000Webhost had been hacked:

https://www.forbes.com/sites/thomasbrewster/2015/10/28/000webhost-database-leak/#5fcf1af96098

My experience suggests that scam emails are much less a threat than even one year ago. Now I get very few, and not even much email advertising. The “bad guys” have mostly shifted to the telephone for their “offerings”. Typically I get five or six a day, with health-related scams being the most common. The rest are mostly financial offers and political. That last category is increasing in frequency as anyone would expect.

I warned my ~50 users about these new phishing emails with your real compromised username and password in them back in July.  Exactly 22 minutes after I sent the warning to my users I received the “Sextortion” scam email Susan linked to in my personal gmail with a 15-20 year old username and password as the subject.  Within a week I had seen multiple of these scams in my corporate SPAM filter and had multiple users report that they had received these scam emails at home.

I’ve gotten 4 notices so far.

Have I been pwned?

1 Mar 2017, one of 995,274 people pwned in the Bolt data breach
7 Oct 2015 one of 30,741,620 people pwned in the Special K Data Feed Spam List data breach
14 Apr 2015 one of 32,939,105 people pwned in the SC Daily Phone Spam List data breach
1 Jul 2012 one of 68,648,009 people pwned in the Dropbox data breach

If I knew an active password of mine had been stolen, I don’t think I’d be posting to a public forum like this one about it. Just having been pwned can make you a target for further attacks. The fewer people who know about your misfortune, the safer you are. Just change the password, close the account if it’s unused or unimportant, and don’t go around sharing your experience, especially not details not yet known to everyone. The fewer breadcrumbs you leave, the less the risk someone else will pick up on the clues and pwn you again.

The one thing you cannot change is a biological fact about yourself, known as biometrics. Once that is cloned or impersonated, you are truly pwned. This fact is one reason I don’t like the idea of using our actual DNA as a biometric.

rc primak wrote:

If I knew an active password of mine had been stolen, I don’t think I’d be posting to a public forum like this one about it. Just having been pwned can make you a target for further attacks. The fewer people who know about your misfortune, the safer you are. Just change the password, close the account if it’s unused or unimportant, and don’t go around sharing your experience, especially not details not yet known to everyone. The fewer breadcrumbs you leave, the less the risk someone else will pick up on the clues and pwn you again. The one thing you cannot change is a biological fact about yourself, known as biometrics. Once that is cloned or impersonated, you are truly pwned. This fact is one reason I don’t like the idea of using our actual DNA as a biometric.

It totally depends on what steps you have taken. For example and most importantly, and as told to me years ago by an FBI agent, never use your real name online.

There is interesting stuff in the news about DNA and about how it is now likely possible (50% or greater) that you can be identified — not by your own submitted DNA — but by DNA which was submitted for testing by family members. Yeah, it takes a lot of online digging, yet this is what recently published research paper showed. Ain’t that peachy? The upshot is that your relatives could unknowingly be undermining your online anonymity.