Hacker News Reader

Comment by a_imho | Hacker News Reader

If you have been on the net long enough this will creep you out: https://haveibeenpwned.com/

Checked with lol@gmail.com, you have to add 14 other 'l's (lolllllllllllllll@gmail.com) in order to result in a green good news. How can I validate the claims? I'm a bit skeptical seeing it doubles as a sales front for 1password.com.

View on HN

It just cross references emails with public hack dumps. I have 7 listed breaches on sites with the email I've had forever. Those accounts didn't compromise my opsec in any way but it is interesting to see. The average person using the net for a while has some on there. It is an interesting tool. If someone is trying to hack you they might start there and see what your old passwords looked like.

Do a bit more research: you'll find that Troy (the guy who runs the service) has been working on this for several years before any involvement with 1password, and so far he's been very transparent about what he does with breach data and also about his relationship with 1password. Whenever he gets access to an unverified dump he first tries to verify its authenticity with the company or service that was pwned, then gets in touch with people whose details are in the dump to verify if the data is real.

I'm aware, but my question is how can I verify it myself instead of taking his word for it.

You'd have to download each of the public hack dumps and check for your email in them.

I've verified some of the reported breaches myself (from publicly available password dumps). It's not a 100% given that those matching means it's all good, but it's a pretty solid indication.

Reply on news.ycombinator.com