The 773M Record “Collection #1” Data Breach (opens in new tab)

Websites put so much effort into tracking every little thing about their users, from where they come from to what they do. Hotjar (https://hotjar.com) goes ahead and tracks mouse movements and now we even have crazy f-ed up startups like Peekmap (https://peekmap.com) that claim to predict eye gaze without the webcam.

And yet they get pwned so easily.

So much effort into violating user privacy, so little effort into enforcing user security.

But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached.

So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehensive, it still leaves users exposed.

I know which password of yours was breached, and that information is now effectively public, but you probably don’t know where to find it yourself, and I won’t tell you which one it was. So I guess just assume all your passwords are cracked and use a password manager.

I don’t really hold it against Troy, because again, I respect his decision not to store plains directly associated with usernames. He did as much as he was willing to with the data, and it’s better than nothing, but not great all the same.

HIBP is quickly becoming a critical piece of the Internet security infrastructure, and Troy should be lauded for undertaking it basically by himself.

I hate to be that guy [1], but no, that does fit in a 32-bit integer - as long as it's unsigned.

From the tweet, it seems like SQL Server puts the result of a COUNT into a signed 32-bit integer, which really surprises me.

[1] I lied, i love being that guy.

But as far as I can see it is gibberish spam-mails. I see 500+ entries such as:

   fkdsjlfjldsf@example.com
   spamkdsjf31@example.com
   fsdjlfsdjkl@example.com

That said if you allow password-based authentication on a server which is shared you might consider using my PAM module:

https://github.com/skx/pam_pwnd

It does lookups of previously-leaked passwords. Best practice these days is SSH-keys for authentication, but this would cover weak sudo passwords too, etc.

Not sure whether it's cool to post any links here.

I'm gonna download the passwords offline and try this plugin: https://github.com/mihaifm/HIBPOfflineCheck

(you can grab the offline passwords from here: https://haveibeenpwned.com/Passwords )

All my passwords are randomly generated so they are different for all websites.

i’ve checked again if i was pwned and on the top there is a service i’ve never signed up - Apollo, a sales acceleration platform

i’m a simple dev and never subscribed to a sales service ....

What should you do now? I mean editing and changing password in everyone of them seems like a daunting task. And many of those services I no longer use anyway.

I am thinking of completely giving up the identity and start over, which seems easier. Or any other thoughts and comments?

Edit: I will definitely pay Apple a monthly fee if there is some simple and easy way to have online identity using email along with FaceID or Touch ID as 2FA. Getting rid of password while increasing security is something that should have happened but has yet to happened.

What did strike me as odd this time is that they did not end op in my spam folder but in my inbox. I'm using Gmail which normally for me has a very good spam/phishing detection. Somehow these mails came through though? Maybe its just an instance and Google was late to catch up with the cat/mouse game on this attack. Or these phishers are getting more sophisticated?

[0] https://darekkay.com/blog/another-password-leak-oh-must-tues...

Maybe it was this one.

Showing 20 bits of the password hash narrows down the possible passwords to one millionth. You should check it locally by downloading the password hash list.