Comment by octorian | Hacker News Reader

Comment by octorian | Hacker News Reader

Parent Full thread

The functional uselessness of ALL site breach notifications from EVERYONE who will send them to you is something that pisses me off to no end.

"Your Email was found in the data dump from the FooBarBaz.NET hack!"

Okay, which site was this? Is there a password I'm supposed to change? Was it actually a password I stopped using 5 years ago, but is still floating out there somewhere?

None of these questions are ever answered in a way that's actionable, so these notices get effectively ignored.

(FWIW, back when I worked at a certain big company and they provided this service to employees, the data dumps actually did contain enough useful info to answer the questions some of the time. But the services available to the general public, even if you pay for them, are damn near useless.)

> Okay, which site was this?

The site it said it was?

> Is there a password I'm supposed to change?

Do you have a password saved or memorized? Does the site have a link or form to log in?

> Was it actually a password I stopped using 5 years ago, but is still floating out there somewhere?

They can't be sure. Why not change it to be safe?

>> Okay, which site was this? >The site it said it was?

I'm sorry, but I have absolutely no idea what sites fall under the banner of the "FooBarBaz.NET" dark web data dump.

What is FooBarBaz.NET supposed to represent? The LinkedIn breach affected LinkedIn for example.

There's a bunch of high-impact leaks that had a rather inscrutable nickname - from the front page of https://haveibeenpwned.com/, I certainly wouldn't be able to tell what does being affected by a "Collection #1" breach mean, or "Exploit.In" or "Anti Public Combo List".

That said, HIBP specifically does provide that information which is more than actionable, and that being the most prominent of these services, I'm not so sure what the complaint is about really either...

Exactly, also, many times I aliased the sign up email or otherwise made the username unique. And I already have unique password, so there just isn't anything to care about for 99% of services.

1Password does give you some useful info by flagging websites which have been known to have database breaches, and it keeps the flag in place until you update the entry with a new password. I think the info is obtained via integration with haveibeenpwned.com.

Reply on news.ycombinator.com