Hacker News Reader

Comment by PuffinBlue | Hacker News Reader

Like most of you (probably) I have more than one email address.

My host 'hacked' email address has been involved in 6 breaches.

Anyone beat that?

No way for me to verify it because I use different username on different sites, and I have a self-hosted catch-all email server, I would have to extract all my usernames or emails from KeePass and check each of them separately... I'm too safe to even know I was hacked.

That might be even more interesting actually. Seeing as you could identify the exact site that was breached. That sort of data would actually be quite valuable to this project I would surmise.

I also have a similar system now as you do, but really only for higher value accounts, not the niff naff forums stuff. And like you it's all randomly generated unique passwords so pretty safe.

None of my site specific emails have been breached yet, which is good as that would mean a major global provider had been breached.

> That might be even more interesting actually. Seeing as you could identify the exact site that was breached. That sort of data would actually be quite valuable to this project I would surmise.

That's why I do it.

The project seems to know where the data comes from, at least in my case it identified each:

    Email 	 	Pwned sites
    dropbox@... 	Dropbox
    ffshrine@... 	Final Fantasy Shrine
    github@... 	 	GeekedIn
    linkedin@... 	LinkedIn
    patreon@... 	Patreon
    tumblr@... 	 	tumblr

(The Github one was using their OAuth - which kinda screws with the traceability)

Unless you're using unique domains, you could use the HIBP domain-wide checker at https://haveibeenpwned.com/DomainSearch.

I have a setup where I have unique emails for each site I register with, but they are all under a specific domain. I was wondering how I could make use of HIBP and this helps immensely – thank you for sharing!

I think that's what you want:

https://haveibeenpwned.com/DomainSearch

I just checked my own domain and there are three addresses pwned that I don't use and never created. I've had the domain for years too.

Probably someone just making up an address randomly but three times is a bit odd.

> Anyone beat that?

Sure: Zero ;)

But that's no real surprise, I try to keep the number of accounts I have to an absolute minimum which is one of the easier ways to avoid this fate.

I've got 15 here, but I've used this address for a long time. I've been using unique passwords for a long time too, though.

Hey PuffinBlue, my email is in 14 breaches :D so yeah, I beat that. (my email is in my profile, you can check)

2 years ago I started using 1password and "user+sitename@domain.com" so I'm no longer worried. I assume all accounts that I haven't migrated are compromised.

17 breaches here :)

Including this breach, I'm up to 13 breaches and 1 paste on my personal email address.

7 spanning 6 years. What's interesting, is that is the account I use for the more mainstream sites. The accounts I use for sites I don't trust, all has 0.

Probably just because the more mainstream sites are more 'valuable' targets for breaches.

This goes not just for hackers, but also for Troy.

If some small site gets hacked there is a much smaller chance that it finds its way to Troy.

I hadn't checked in a long time, I have 13 now. Wow.

A very old email I've used a long time ago has been involved in 7 breaches and 1 paste. None of these passwords have been valid for years though.

16 sites (+2 pastes) with an old email address.

17 and 2

Reply on news.ycombinator.com