These data breaches where the source isn't known can be frustrating. As someone who already uses unique passwords for everything, there's not much I can do (change 500+ passwords?). And I can understand Troy's argument[1] for not sharing the leaked password, so that doesn't leave many other options.
I guess I'll just start going through my saved passwords and use them to delete all of the old accounts I rarely use, maybe with a little help from the GDPR.
My solution for this is to use a unique email address for each site/ service. That way if I see that hn@mydomain.com has appeared in a breach, I know both where the leak came from and which password to change. Also helps identify the source of any spam emails...
Gmail and other MTAs support +something in the e-mail address user part too. If you forget your password, you do have to dig through your e-mail and figured out which one you used, but this method does let you track down when someone sells/shares your e-mail address or 3rd parties.
You just have to remember the exact username/email you used in case you forget it. That can include the sitename itself, or some simple transform, but sometimes services change names... so make sure to keep records of exactly the email used for each service (or don't delete your email from them), forgetting that is worse than losing the password, since there's often no helpful recovery service they offer.
Yes. More and more sites are using common frameworks and/or validation libraries where a + is not considered to be an acceptable part of the recipient name.
I really don't think HIBP should even be publishing or notifying people about these. It's almost always existing breaches just merged together in a different way. If I went and grabbed the raw torrents and combined them in various ways I could make hundreds of different "credential stuffing" lists. Would HIBP list and notify people about all of them?
This post doesn’t mention it, but on past credential stuffing lists that got loaded, Troy mentioned how many were new to the HIBP dataset. I’d assume that there were enough new emails on here to make it worth loading.
94% of the email addresses were already in the database according to the Twitter account. 6% still represents many millions in this case, but perhaps it's unnecessary to notify the ones already known.
Once the huge password Torrent is updated with Pemiblanc (9 GB, last updated March 1, 2018), you can download it and scan it for all your passwords locally. Then you can determine which are pwned. You'll have to SHA-256 them all, but that shouldn't be too hard.
I've never tried to follow up with which accounts/passwords have been used from haveibeenpwned, can you describe this further as I'll try this.
The "huge pw torrent" is something I can just search on torrent trackers? Once I have the list, its just a list of passwords, or includes the emails? Then they're sha-256 hashed and I need to ..unhash them?
I think he is referring to Troy Hunts pwned password list.(which is about 9gb, afaik) Presumably it will be updated with these new plaintext passwords.
Once it’s updated, you can check all your passwords against the list. It’s a list of sha256-hashed passwords.(so he isn’t sharing tons of plaintext passwords, as sha256 can’t be reversed) You would sha256 your own passwords and check them all against the list.
Edit: to clarify, I think there are tools to help check against the offline list pretty easily. Or you could also query Troy hunts pwned password page (or its api)once it’s updated; instead of downloading 9gb. The k-anonymity model is pretty clever, and querying the site should be secure.
I think Firefox is going to use Trent's list to check passwords use when browsing. That would actually make Firefox more functionally useful that other browsers.
I guess I'll just start going through my saved passwords and use them to delete all of the old accounts I rarely use, maybe with a little help from the GDPR.
[1] https://www.troyhunt.com/here-are-all-the-reasons-i-dont-mak...