Hacker News Reader

Comment by StavrosK | Hacker News Reader

Does anyone have the password section of the dataset? My email address is in the list, but I care more about which (if any) of my passwords was exposed.

View on HN

The blog seems to indicate that this list appears to be made up of previously leaked/available lists that were already out in the wild.

It indicated LinkedIn as one of the likely sources.

I know an email address that appears in this leak but not in any other leak that hibp knows about. That might invalidate that hypothesis (or alternatively hibp's dataset might not be as complete as it could be).

hipb dataset is rather lacking.

The spam list is 711M emails. The post indicates that it's made up of several existing datasets combined together.

I wasn't implying this was just LinkedIn data, apologies if my tl;dr of the article wasn't clear.

You should just read the blog post.

https://haveibeenpwned.com/Passwords

I wouldn't use the form, but that page also has download links of password hashes for you to check locally.

I believe there's a new section of the site where you can enter the password and see if it's been pwned, it should've been updated to include this latest dump.

that... seems like a bad idea.

Yes, just intercept the connection or some phishing server and you are really pwned.

If that https connection can be intercepted, you might have more to worry about.

Btw this is the page: https://haveibeenpwned.com/Passwords

and before you complain, at least read Troy's article where he introduces this service.

https://www.troyhunt.com/introducing-306-million-freely-down...

Oh wow, what? Why would anyone encourage this? The data is out there, it's a public dataset, just show me the password or a hash of it or something.

The site does say "Do not send any password you actively use to a third-party service - even this one!"

I think what he's getting at is whether there is a place where he can look up whether his email, in combination with a password, was leaked.

At the very least, I wish HIBP could distinguish between whether the data contains an email-plus-password or the email address only.

It does.

It indicates what data has been disclosed for each hacked source (Email, Password, Usernames, Credit cards, Names, etc).

Reply on news.ycombinator.com