Hacker News Reader

Comment by asdfaoeu | Hacker News Reader

Maybe you should ask for credit card numbers and passwords to check if they have been compromised.

Troy Hunt explained somewhere that he doesn't actually store the password (hashes), nor does he want to.

See the FAQ as well: https://haveibeenpwned.com/FAQs

Assurances only go so far. Even if he's a perfectly ethical person, if his service provider is compromised then all bets are off.

But, as some replies accurately pointed out, the email addresses are already out there and are not that big a deal anyway.

This [0] is an article written by Troy Hunt (the researcher behind HIBP) on the value of email addresses, and answers the question "Can I trust you with my email address?" (in relation to HIBP).

[0] http://www.troyhunt.com/2015/11/im-sorry-but-your-email-addr...

Everything he has in HIBP is taken from public releases. It's already out there, there's not level of 'really out there now.'

Yes, not making the email addresses easily searchable is the worst type of security through obscurity. The type where it's only obscure to you the email address owner, but not to those who would like to exploit you.

He's not interested in becoming a search engine for finding exploited accounts.

I understand, and I believe I was agreeing with you. I was merely noting that while making it searchable takes the difficulty from slightly inconvenient to easy for those who might want to exploit it, it also takes the difficulty from very hard to easy for the average person who may want to defend against it (by determining if they are at risk). I believe that's a net positive.

What do you mean it's not easily searchable?

You put your email in and it tells you if it was ever part of a data breach. You can even subscribe for future notices in case it's found in a breach in the future. What more do you need to search for?

I was replying to the up-thread position[1] summarized as "providing a searchable interface is dangerous because bad actors can use it against you." The context of the thread[1] apparently makes my meaning (that it's okay that it is searchable) somewhat hard to intuit.

1: The thread no longer appears to imply what I thought it was. I don't know whether that's because some comments were edited or because I was just in a state of mind which made me interpret them differently, but I don't think it really matters. My statements were meant to be general for this type of situation, and apply towards the merits of searchable vs non-searchable email addresses, not to assert that this site did one or the other and apply judgement because of that.

https://canar.io supports hash lookups for leaked passwords

Yup. Coming down the pipeline will be hashing of suspected password lists being posted too.

(I am the creator of Canario)

Is there any way I can guess at my password from the Gawker leak?

I believe that the passwords were exposed in the breach but at the moment I don't have them to look at.

Generally I recommend that if you think that your password has been exposed that you just reset your password as if you have to ask that question then you might want to reconsider your password reuse.

Reply on news.ycombinator.com