Two billion email addresses were exposed

I used per-account email with alias services and password managers.

Also started migrating old accounts in free time.

Now its pretty easy to tell the source of leak by email addresses as well as sources of spam.

---

Per-account alias might sound much, but using sieve filtering [1] is amazing, and you can get a comprehensive filtering solution going with 'envelope to' (the actual address receiving the email) + 'header to' (the recipient address you see, sometimes filtering rules don't filter for BCC or sometimes recipients are alias instead of your actual email) that are more comprehensive than normal filtering rules to sort your emails into folders.

[1]: https://datatracker.ietf.org/doc/html/rfc5228

---

Amusingly, I've managed to recover old accounts from emails that contains my old passwords with demands for crypto payment, it just provided me enough help to recall old variations of my passwords.

Same, and I find it really difficult to care about it anymore.

It was leaked through no fault of my own. There are 0 actual consequences to companies doing it. So what am I going to do - stew about it??

+1 for Bitwarden. It is literally the best solution out there. Been getting to increase uptake in personal circles with (very) limited success. The wife keeps trying to convince me that the ship has sailed in trying to protect info online. She's probably right.

Addresses? Most of the time addresses are a matter of public record. I have used https://www.fastpeoplesearch.com/ a couple of times to search for people's addresses and it really works. One day a close friend excitedly told me she bought a new house and I told her the address before she told me about it.

Telephone number? There used to be phone books. And I still instinctively think they should be public.

> what if anything can be done at this point

I'm in a similar situation, just make sure your credit is frozen with the 3 major US companies. I had someone steal like $50 of cable TV with my info in another state and it was a major pain to get off of my credit report.

I was in the military. China stole my freaking DNA profile. I've given up on worrying about this stuff.

I use unique email addresses per domain name, and I believe IHaveBeenPwned shows me at 39 unique email addresses breached! (So many that seeing which ones have been breached would now cost me $22 / month... IHaveBeenPwned is starting to feel like an extortion racket of its own..)

To confirm, data/info leaks happened on the server/application side. How does a solution like Bitwarden on the client side helps with this situation?

As per my understanding the only possible threat it saves against is someone trying to brute force for your password against the application. And may be ease the cognitive burden of remembering different passwords.

Right to be removed/purged and maximum retention policy. One place I'm aware of purges accounts that have been inactive 18month. Historical billing info is offline and "gapped"

It's probably more important to keep passwords safe, but lots of people treat their email address like some kind of "sensitive secret". "Oh but I don't want to get spam" - my dude you are going to get spam.

There's a guy who lives near me who, when he parks his car, very carefully puts tape over the number plate "because otherwise people might see my registration number". Because apparently if people can see your car's registration number they can somehow just steal your car and the police won't do anything because the number plate was visible. Mad, absolutely barking mad.

Even if you weren't breached, the sophistication is getting higher too. New hires get emails starting literally day one because email formats follow a pattern and they posted their new job on linkedin (or something).

Exactly this.

Does anyone still care?

I like how the Apple Password app informs you about Compromised Passwords so you can you know... go in and fix it, get a new password etc.

Nice little cute idea.

I got 717 warnings. Seven hundred seven teen.

No I will never be able to fix this

I bet now some corporations actually want to be exposed, have data breach. If you have not been in the news, it means you have not made it yet (not popular enough to be a target worth writing about).

I generally don't give my real address or real phone number to anyone who doesn't legally need it. I use a virtual address as the billing address on my credit cards and for registering for things that don't need to know where I sleep.

The government can have at my real info, but private companies have bad data security.

So by this point, if anyone does anything naughty online they could just pin it on an hacker using their identity, no?

freeze your credit at the three major companaies.

Right. Having some data leaked isn't really a boolean, leaked/unleaked. It's a list of leaks, and the implicit map betweenyl your datapoints, whether by intra or interprovider mapping

For example a forum might leak a map between your mail and a password; Implicitly your affinity for that forum's topic is also now on the public record, additionally if your posts were public but under a pseudonym, that might be now known by a sufficiently motivated attacker.

Finally this may be linked with other public datasources like your public tweets or public state records, or even other leaks.

This is why the meme about all ssn's being leaked or about a list of all valid phone numbers is so asinine.

[dead]

Not necessarily. Both my main addresses still come back clean after years in use.

The one I use for random crap has 9 hits though.

You'd think spotify as a mature company would have had obligations to report this stuff!

> there does not seem to be any way for _me_, the person affected, to know what password were breached

You should be using a unique randomly-generated password for each website. That way, one breach doesn't lead to multiple accounts getting hijacked AND you'll know which passwords were breached solely based on the website list. The only passwords I still keep in my head are:

  1. The password to my password manager
  2. The password to my gmail account
  3. The passwords for my full disk encryption

I used to reuse the same password for everything, and that lead to a pretty miserable month where suddenly ALL of my accounts were compromised. I'd log in to one account and see pizzas I never ordered. Then I'd open uber and see a ride actively in-progress on the other side of the country. It was not fun.

> It seems like we must rely on our password managers (BitWarden, 1Password, Chrome's built-in manager, etc.) to tell us if individual passwords have been compromised.

Yes.

If you read the instructions, you will discover https://haveibeenpwned.com/Passwords which will let you enter a password and securely check if it has been published in a breach.

If it has, it is either a simple password that multiple people are using, or a complex secure password that can make you pretty confident it is your password that has been published.

1Password just does the same thing for all of your passwords - it doesn’t check against your account name either. That information isn’t stored so they can’t become a new source of breached accounts (as explained at the site).

The problem with breaches like the latest data set is that there's no source on where the breach came from, it's an aggregate from multiple breaches. They can't tell you that info because it's not in the initial data set.

At one point I responded to a haveibeenpwned notice by immediately having the user reset a password.

I've got over 200 users in a domain search (edit: for this particular incident), and nearly all of them were in previous credential breaches that were probably stuffed into this one. I'm not going to put them through a forced annoyance given how likely it is the breached password is not their current one, and I'm urging people to start moving in this direction unless you obtain a more concrete piece of advice.

The details about the “Stealer Logs” on the dashboard even state:

> The websites the stealer logs were captured against are searchable via the HIBP dashboard.

There is no way to use the HIBP dashboard to figure out what domains my email address appears against.

Am I meant to change all passwords associated with that email address? Or do I need to get a paid subscription to query the API to figure out exactly what password(s) to change?

This has always confused me. On the one hand, HIBP is an invaluable service, but, on the other, it does nothing more than stating you’re in trouble, with no clear way forward.

https://haveibeenpwned.com/Passwords

One possible solution could be to give you an option to send the affected password as a list to the mail address you specify, then only people with access to that mail address will see them

Yeah and I am confused by his new setup private vs business. I got that mail too but can simply not see what addresses were affected by that breach.

> But the site does not give me any way to take action.

It gives you as much information as you should be given. Any more information would just be spreading around the hacked dataset.

It does give you an awful lot of information about the specific hacks that exposed your information, and what was the content of that exposure. You may have been owned, but the way you were owned doesn't really matter e.g. I don't care that my firstname.lastname@gmail.com was exposed as being me. I may not care that my username@yahoo.com account was exposed as being username at archive.org. If that's it, I can keep using them. But a lot of hacks are a lot worse, and you might have to rearrange things or close them down. haveibeenpwned gives you enough information to make all those decisions.

Also, your second paragraph seems to imply that the site doesn't tell you if passwords were compromised for an email address. It definitely does by identifying the hack and describing its extent. You don't need the actual password to know that you need to change it. Likely, the hacked site forced you to change it anyway.

What? You expect the guy to tell you your password? Lol, lmao even.

I know roughly what passwords were exposed because either I remember it, or the date of the leak or the associated email.

I know simple passwords are almost public and that leaks of say linkedin will be properly hashed, while a vb forum from 2006 might not be.

The domain search feature on haveibeenpwned is/was free. I registered my domain on haveibeenpwned back in 2017 and I got two emails about breaches, one in 2020 and another in 2022. I did not pay.

Isn’t the idea that you don’t need haveibeenpowned since you’ll see mails coming in and then know your details have leaked?

For ID fraud, more than an email address has to be leaked.

I'm in the same boat. I track all of the unique addresses I use (via my password manager) so I guess I could just check them all against HiBP's database. Kind of a pain in the ass, though.

Just assume they have all been exposed.

Email addresses are not secrets under any stretch of the meaning of that word.

Troy's response [1] on this use case from a couple of years ago was that you should buy a monthly fee and then cancel it.

[1]: https://www.troyhunt.com/welcome-to-the-new-have-i-been-pwne...

I don't understand... The password is the secret, right? If your mastercard login ends up in some breach, your password is protecting. You without or without vanish urls, if you have strong passwords you'll be fine.

You need a domain, and possibly a paid mail provider with catch all support.

So cost was always part of this strategy

I have the more typical one email used with hundreds of passwords on many websites. haveibeenpwned is also useless for me, it will tell me that my email was compromised but not which sites or passwords. I guess I could check each password individually, hope each password is globally unique to me, and then try to match it back to the website where I used it so I can change the password.

> The utility of Have I Been Pwned approaches zero the longer you have been on the internet, and I have been on the internet since the late 1990s.

I mean if your 1Password is green then HIBP has definitely helped.

First of all, without HIBP, you wouldn't have Watchtower.

HIBP has raised awareness on having unique passwords per site.

HIBP has achieved that multiple services now can and check if particular password is leaked or not.

Of course you could argue that since your security hygiene is so good you don't need HIBP. True. Let's pretend every people on planet will be generating unique passwords per service. Great. HIBP will have achieved enourmous job of making the planet more secure.

And still a notification if you appear in some breach that can be attributed to a service - good signal to change password.

Hats off for you cycling the password.. Have you ever ran into problems with that? Say you kinda rotated password but it no longer is accepted or something?

One of the drawbacks of using a custom domain for personal email is you essentially have to pay for it for life, otherwise anyone can just buy your old email address if the domain expires and start receiving mail, resetting accounts... I think some folks don't fully consider this consequence when setting up a fun vanity email address or similar etc, especially now both iCloud and gmail have made it so trivial to link a custom domain.

What a lot of work to capture one account.

Which is incredible because it means they paid to get the domain and try to access that account. I can't imagine why anyone would care that much about your Facebook (assuming you're not someone who's especially influential) and yet here we are

Domain search is free. I never paid for HIBP and they give me a list of every address @my-domain that’s been leaked.

Edit: others are pointing out that it’s only free for domains with fewer than 10 pwned addresses. I have 8.

> I'm not clear why any solution to insert new records would take 2 weeks...

The article mentions some of the challenges, like 1.9e9 sha1 hashes. And 1.9e9 row updates performing poorly in-place, so they created a separate table for the results. Then they got rate limited by email providers when they wanted to tell people about their pwnage

Thought the same thing, and agree completely with jiggawatts. Troy does very well off the back of this relationship, and on that note I hate how confusing the marketing language of "Microsoft Regional Director and MVP" is.

> we run on Azure SQL Hyperscale

Definitely the wrong technology, and was almost certainly picked only because Troy Hunt is a "Microsoft Regional Director and MVP".

Many other technologies scale better for this kind of workload. Heck, you could ask ChatGPT to write a short C# CLI tool to process the data on one machine, you don't even need a huge box.

This kind of thing comes up here regularly on HN for problems such as duplicate password detection, leaked password filtering, etc...

After previous brainstorming sessions the general consensus was that it's really hard to beat a binary file that contains the sorted SHA hashes. I.e.: if you have 1 billion records to search and you're using a 20-byte SHA1 hash, then create a file that is exactly 20 billion bytes in size. Lookup is (naively) just binary search, but you can do even better by guessing where in the file a hash is likely to be by utilising the essentially perfectly random distribution of hashes. I.e.: a hash with a first byte value of "25" is almost certainly going to be 10% of the way into the file, etc...

It's possible to create a small (~1 MB) lookup table that can guarantee lookups into the main file with only one I/O operation of a fixed size, such as 64 KB.

Sorting the data is a tiny bit fiddly, because it won't fit into memory for any reasonably interesting data size. There's tricks to this, such as splitting the data into 65,536 chunks based on the first two bytes, then sorting the chunks using a very ordinary array sort function from the standard library.

On blob storage this is super cheap to implement and host, about 50x cheaper than Azure SQL Hyperscale, even if it is scaled down to the minimum CPU count.

DM me your passwords Ill do it for you

Not just this but the lack of diligence by companies that allow accounts to be created, bills to go unpaid & then sent to collection agencies is something that needs to change.

Speaking as someone who has had companies give away my PII and then other companies open accounts with it without contacting me until bills are due.

None of this should be the fault of innocent individuals.

We need to make storing customer data and recommendation algorithms a liability.

Are you sure you typed the right email address?

My 2012 Dropbox leak still shows up for my account.

I agree. I wish it would tell me the password, there is a good chance I could identify the service that it came from based on the password. This way it doesn’t feel that useful.

The number of passwords is probably smaller. ;)

I don't care for most things, but banking is one place I've been bitten pretty hard without even getting hacked. Not going to extremes to protect it, just gonna make sure it's decent.

Any interesting finds on companies that tried to sell your data?

I just learned that FastMail provides an iOS shortcut to "Create Masked Email".

Just be careful, you must press Save after or else you'll lose it.

If you're happy with Bitwarden, I think you should stick to that. I'm currently using 1Password, I switches after the security issues with Lastpass. Later I did try Bitwarden but was unhappy with the ability to correctly identify username and password fields on websites. Others tell me that they have more a better experience with Bitwarden, so I might have to give it a try again.

1Password is really nice, but it's also expensive, compared to Bitwarden.

1Password is awesome.

I haven't really looked at anything else but I found >2 years ago the UI of BitWarden to be ordinary. And it was more awkward to manage a company.

Went with 1Password in the end, and that you get a free Family account with a Business account is great.

Your position on how BitWarden is open source should contribute to any decision you make though.

I suggest KeepassXC + SyncThing + KeepassDX (for Android)

It's not about the email addresses themselves. Those are just the identifier by which things can be discovered on haveibeenpwnd. The point is that when email addresses rae stolen/leaked, they're usually accompanied by passwords, addresses, CC information etc.

In some cases the email address combined with the name of that site that leaked it can be enough to get people in trouble. E.g. "niche" dating sites.

A lot of companies and services are storing unsalted hashes of passwords. Which is not much better than storing plain-text passwords.

It's becoming less and even languages with a "strong legacy body" like PHP have sane defaults nowadays, but I do see them around when I do consultancy or security reports.

"Never fix something that aint broken" also means that after several years or a decade or more, your "back then best security practices" are now rediculously outdated and insecure. That Drupal setup from 2011 at apiv1docs.example.com could very well have unsalted hashes now. The PoC KPI dashboard that long gone freelancer built in flask 8 years ago? probably unsalted hashes. And so on.

Given enough time, hashes are reversible via brute force.

If the attacker steals the entire password table undetected, they have a large amount of time to generate soft collisions. After all they don’t need to hack any particular account, just some 50% of the accounts.

The time can be increased by some coefficient via salting, but the principles remain the same.

Just check each unique password and then you know which sites need a password change?

This is also known as "warming a domain" in the email world. A large rush of emails from an email server is an indicator of a hack or takeover, so anti-spam software may flag an IP address that surges in activity.

Another commenter mentions ProtonMail, but somewhat unadvertised is with a paid Proton sub (I forget which tier), you also get access to SimpleLogin. It's a service which lets you create new email aliases with your domain that just send them to another email you own. (Also lets you send emails as that alias, so the other end doesn't see your real address.)

I use it with Vault/Bitwarden, which lets me generate email addresses of format `<uuid>@my.domain.com` when I create new login info for services.

I know you can set up "catch-all" email with a custom domain through Proton Mail.

I don't think there's any limit on gmail + codes.

Use a catch-all inbox. Fastmail supports them well in its web interface. I use unique addresses for every organisation.

https://simplelogin.io/

duckduckgo's free email aliases. Can use it as a front-end and keep your existing domain

proton unlimited, i think. mail plus doesn't seem to do it, which kinda sucks.

check simple login. they were both by Proton, but you can use them without the parent.

How much did you donate to keep HIBP running?

What is the URL to your free HIBP alternative?

if we could have standardization like that, we wouldn't need passwords

If there was a standard, do you know how long it would take to get adopted across the interwebs.

Passkeys essentially solve this, however they are not backwards compatible. If they were backwards compatible (e.g. an automated way to change passwords) then you might as well just enable Passkey as a replacement. Thats the conundrum.

I feel like we missed the chance to have a standard http resource for this stuff.

That's passkeys. Google and Microsoft are pushing in that direction.

How are you going to sign in and delete the public key, if you lost the private key?

This is exactly why so many do not want passkey, the recovery options aren't exactly great.

Anonimity on the Internet is going out of vogue.

The only way to fix the ToS issue you raised is through regulation protecting it.

Unfortunately we're going the other direction, with efforts like verified ID gaining traction in some parts of the world.

It's ironic because in most cases anonymity (or allowing an alternate identity that has its own built-up reputation) would offer real protection, while the verification systems are arguably security theatre.

I don't care what technical genius is built into your architecture, as soon as you force a user to plug their ID information into it, they've forked over control along with any agency to protect their own safety.

The ad tech companies can associate any fake identity with your real identity. So no, there is no problem. Good thing that all ad tech companies are fully on the up-and-up and have never been compromised to spread malware.

Service providers generally use your name and address to validate your billing method.

If you can pay by some method that doesn’t require name or address then go ahead and use a fake name.

I mean, for some services, likes banks / credit cards, it's required..

For others, I try to stay anonymous / aliased where possible.

> Oh - and 1.3 billion unique passwords, 625 million of which we'd never seen before either.

It's not just email addresses. It's address + password combos.

But also, how did 2 billion email addresses get exposed? Assuming I give an email address to a company (and only that company) if someone gets access to that email addresss they either got it from me or that company. Knowing the company has sold, lost, or poorly protected my email address tells me they are maybe not worth working with in the future.

Could leave to massive impersonation attempts. All the folks here on HN are probably very tech savvy, so we’ll likely have a strong password + 2FA. But mom and pops that just got their email addresses leaked? Probably not. So they might start just trying out a rainbow table of common passwords and getting access to peoples emails. Once you’re there getting to home banking and other privileged resources is not hard.

Until they figure out the password to that email and then take over everything else in your life. They are not collecting email address because they are useless.

It’s not the email address itself that’s important, it’s that the email address is a key identifying users in data breaches. The email addresses are presumably linked to breaches of pii or passwords etc.

One reason is spam. The other is that in many cases passwords are leaked too.

Yeah, I agree. I consider them like public keys or IPs.

Troy Hunt’s brand is to exaggerate secret risk.

Can anyone recommend a good third party service that provides similar functionality and a great user experience?

For those of us who don't want to entrust this to Apple and who'd like to use our own domain?

None of that is true, but you keep your outrage going.

Troy Hunt has been running Have I Been Pwned for years. He even uses the k-anonymity model to allow you to search if a password has been pwned without giving him the password if you don't trust him.

I get your general point, but he's been a leader in this space and walking the walk for a decade. I'm not even into security stuff or anything particularly related to this, and I still recognized his name in the OP domain.