Slashdot Mirror

← Back to Stories (view on slashdot.org)

'Have I Been Pwned' Is Being Integrated Into Firefox, 1Password (troyhunt.com)

Posted by BeauHD on from the privacy-matters dept.

Troy Hunt, web security expert and creator of the website Have I Been Pwned (HIBP), wrote a blog post announcing his partnerships with Firefox and 1Password. For those unfamiliar with the site, Have I Been Pwned allows you to search across multiple data breaches to see if your email address has been compromised. The service is especially handy now that data breaches are becoming a daily occurrence. Hunt writes: Last November, there was much press about Mozilla integrating HIBP into Firefox. I was a bit surprised at the time as it was nothing more than their Breach Alerts feature which simply highlighted if the site being visited had previously been in a data breach (it draws this from the freely accessible breach API on HIBP). But the press picked up on some signals which indicated that in the long term, we had bigger plans than that and the whole thing got a heap of very positive attention. I ended up fielding a heap of media calls just on that one little feature - people loved the idea of HIBP in Firefox, even in a very simple form. As it turns out, we had much bigger plans and that's what I'm sharing here today. Over the coming weeks, Mozilla will begin trialling integration between HIBP and Firefox to make breach data searchable via a new tool called "Firefox Monitor." Here's what Hunt has to say about 1Password: As of now, you can search HIBP from directly within 1Password via the Watchtower feature in the web version of the product. This helps Watchtower become "mission control" for accounts and introduces the "Breach Report" feature. If you're a 1Password user you can use this feature right now, just head on over to the 1Password login page.

61 of 111 comments (clear)

  1. I have been pwned by Master+Moose · · Score: 3, Funny

    Looks like my junk address that I set up for all my junky things has been junked!

    --
    . . .gone when the morning comes
  2. Have I been Pwned? by dohzer · · Score: 1, Insightful

    Want to know if you've been pwned? Enter your email address right here to start receiving junk mail.

    1. Re:Have I been Pwned? by Anonymous Coward · · Score: 1

      I'lll get to it in a minute; right now im still busy uploading nudes to facebook...

    2. Re:Have I been Pwned? by thegarbz · · Score: 4, Informative

      Want to know if you've been pwned? Enter your email address right here to start receiving junk mail.

      I signed up to this. I have received:
      On the day of signup: 1 confirmation email.
      5 months later: an email notification about a breach.

      That was years ago. If this is the source of your junk mail then you must have the cleanest damn email inbox in the entire world.

    3. Re:Have I been Pwned? by Anonymous Coward · · Score: 1

      Want to know if you've been pwned? Enter your email address right here to start receiving junk mail.

      I signed up to this. I have received:
      On the day of signup: 1 confirmation email.
      5 months later: an email notification about a breach.

      That was years ago. If this is the source of your junk mail then you must have the cleanest damn email inbox in the entire world.

      I concur. I have only received a confirmation mail for each account I registered. Of course, that will all change once HIBP gets Pwned.

  3. To check if your password has been pwned by piojo · · Score: 4, Informative

    To check if your password has been pwned without submitting it to them, find the sha1sum of the password, then use their API to check it. For example:

    sha1sum: 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8
    first five characters: 5baa6
    the remaining characters: 1e4c9b93f3f0682250b6cf8331b7ee68fd8

    Use the prefix to visit their API:
    https://api.pwnedpasswords.com...

    Then search for the remaining characters in the page shown.

    (I suspect even if you use the web form, it will only submit the sha1sum, but this is still safer.)

    --
    A cat can't teach a dog to bark.
    1. Re:To check if your password has been pwned by butzwonker · · Score: 1

      Sha1 is not even considered secure any longer...

    2. Re:To check if your password has been pwned by johnsie · · Score: 1

      Assuming you're dumb enough to use the same password for multiple sites.

    3. Re:To check if your password has been pwned by piojo · · Score: 3, Informative

      If they have your password, it is your password regardless of where they got it. Certainly if the password was part of a valid username/password pair, it's more problematic, but if the password is in this list, it will be relatively easy to crack. Being in this list is like being in a dictionary—it is likely that a cracker will try it if he makes a serious attempt to break in to your account.

      --
      A cat can't teach a dog to bark.
    4. Re:To check if your password has been pwned by higuita · · Score: 2

      If the password is in the list of known passwords, do not matter if it is yours or not, those are the passwords that bruteforce tools will try first... you know, testing one million passwords is way lot quicker than testing several trillion of passwords

      --
      Higuita
    5. Re:To check if your password has been pwned by higuita · · Score: 1

      it is not secure as it may be possible to create hash collisions with some time... but to hash a passwords is still perfectly save, you can't reverse a hash to get the password and bruteforce it is still a huge amount of combinations

      --
      Higuita
    6. Re: To check if your password has been pwned by Zero__Kelvin · · Score: 2

      It is a myth that you can usually brute force a login system. That hasn't been a thing since they invented password shadowing. Any decent online system will have methods to make it impossible as well.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    7. Re: To check if your password has been pwned by Anonymous Coward · · Score: 1

      No you donâ(TM)t brute force a remote login session. You copy the passwd database locally and brute force it there.

    8. Re: To check if your password has been pwned by higuita · · Score: 1

      bingo!

      --
      Higuita
    9. Re:To check if your password has been pwned by Dragonslicer · · Score: 1

      it is not secure as it may be possible to create hash collisions with some time... but to hash a passwords is still perfectly save, you can't reverse a hash to get the password and bruteforce it is still a huge amount of combinations

      No, it isn't considered safe, because computers can compute SHA1 hashes fast enough to make brute force attacks feasible. You should be using computationally-intensive algorithms such as PBKDF2, bcrypt, etc.

    10. Re: To check if your password has been pwned by Zero__Kelvin · · Score: 1

      The sad thing is many people will read what you wrote without laughing.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    11. Re: To check if your password has been pwned by Zero__Kelvin · · Score: 1

      No, not "Bingo". If you have that kind of access you are already in and don't need passwords.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    12. Re: To check if your password has been pwned by Zero__Kelvin · · Score: 1

      You just switched to a completely different subject. The discussion is about secure systems and system security in theory. Your argument amounts to "You can't create a secure system that way because there are insecure systems that exist"

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    13. Re: To check if your password has been pwned by higuita · · Score: 1

      let me check, i found a SQL injection in some random site, i dump the user emails and passwords, i crack then, i find some good auth pairs and now i will login to other totally different places.

      I do not care if linkedin or adobe was hacked... but i do care about the info stolen, that can open million of accounts in millions of other sites to hackers and god knows what that may open (vpns, private files, auth data, inject trojans, send phishing attacks from known contacts)

      so no, hacking a forum server will not give you all that, but hacking passwords could do it

      --
      Higuita
    14. Re:To check if your password has been pwned by higuita · · Score: 1

      a password that match a sha1 hash may not be the password that generated that hash ... but yes, they should improve that

      --
      Higuita
    15. Re: To check if your password has been pwned by Zero__Kelvin · · Score: 1

      Again, nobody was arguing that password reuse was a good idea, and that is literally a different subject. You may be too new to the scene to understand how effective "John the Ripper" style offline cracking techniques were in general, and why they invented password shadowing to close the attack vector.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    16. Re: To check if your password has been pwned by higuita · · Score: 1

      who is talking about system accounts? to "login" to a account is not only login to a system account, it is also login to any web site. :)
      i know no password shadowing in web systems, as protection of SQL injections attacks or hacked machines dumping the database

      --
      Higuita
  4. What? by owenferguson · · Score: 1

    Why do I care if someone else mishandles the unique bullshit I gave them once upon a time. Surely, if I were stupid enough to use my email address as ID on someone else's computer, they would have a moral responsibility to use that email and contact me to let me know about the breach. If not, why do they want my email in the first place?

    1. Re:What? by higuita · · Score: 1

      fine, you are one of the few that really create good passwords... yet almost everyone i know that are not tech pros use stupid simple passwords, reuse passwords all over the place and do not understand security. This tool is for then, to help then understand that sites get hacked, passwords stolen and they should change passwords and not reuse passwords

      --
      Higuita
  5. Don't need no Have I Been Pwned by Rosco+P.+Coltrane · · Score: 1

    Those of us who are security-conscious know they haven't been pwned. Those who don't use weak passwords, reuse the same password across multiple logins, and submit their email addy on random websites for more pwnage.

    --
    "A door is what a dog is perpetually on the wrong side of" - Ogden Nash
    1. Re: Don't need no Have I Been Pwned by Zero__Kelvin · · Score: 3, Informative

      And those of us with an actual clue know that while much less likely than the layman's case we have no way to be 100% certain we *haven't* been owned. Yours is a mild case of Dunning Kruger I'm afraid.

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    2. Re:Don't need no Have I Been Pwned by higuita · · Score: 1

      right, because you audit and configure all the sites you use, to make sure they aren't also hacked and your data stolen...

      if you were really security-conscious guy, you would never said something like that

      --
      Higuita
    3. Re:Don't need no Have I Been Pwned by Bob+the+Super+Hamste · · Score: 1

      While I do take proper measures to protect my data it seems that a lot of sites and businesses don't seem to care. There was one financial company that I dealt with that clearly stores passwords in plain text. I had to call them to get an issue resolved and there the person on the other end of the phone asked for my password as confirmation that I was who I said I was. Needless to say the accounts I had there are no longer there. I did similar test with the new financial company to see if they screwed it up that badly and while I can't be sure they at least didn't ask for my password over the phone. Then again they all seem to use your name and last 4 of SSN as good enough authentication.

      At this point even though I take steps to protect myself I just assume that those who have my data aren't protecting it properly and it will leak. So with this mindset good personal security measures mean that all I am able to do is limit the damage. A better way of thingking would be :
      "Those of us who are security-conscious assume we will get pwned"

      --
      Time to offend someone
    4. Re:Don't need no Have I Been Pwned by aaarrrgggh · · Score: 1

      Fundamentally disagree. I use secure site passwords with a few exceptions, but they are stored somewhere, and I have a few "systems" depending on risk.

      But, if someone knows the root of my system, they could easily brute force a number of passwords.

      Or, they could hack my wife's iPad which has all my super-secure passwords in plain text...

      There is always a weak link, and that list of weaknesses is likely less than 30-50 things.

  6. Have Jehovah's Witnesses taken over 1Password? by tepples · · Score: 1

    As of now, you can search HIBP from directly within 1Password via the Watchtower feature in the web version of the product. This helps Watchtower become "mission control" for accounts

    Has the Watchtower Bible and Tract Society taken over 1Password? I wouldn't trust that organization with my online accounts for several reasons.

    1. Re: Have Jehovah's Witnesses taken over 1Password? by bestweasel · · Score: 1

      The JWs noticed those wacky Mormons adding billions of names to their books and wanted a slice of the holy database action, so now, according to researcher Orla Long, The Watchtower is being used to amass email addresses to save souls via the internet.

  7. Password manager by tsa · · Score: 2

    Which password manager do you recommend? 1Password doesn't work on my old iPad with iOS 9, so that one is ruled out. Besides, I'd rather pay for a password manager than use a free one because 'free' means: "We know exactly which websites you visit and will sell this data gladly to everybody we meet."

    --

    -- Cheers!

    1. Re:Password manager by Dwedit · · Score: 1

      How about client-side salted hashes? Nobody can randomly guess something like 63DA4171F2D985441F1AE0C4F3C2AA27 as a password.

    2. Re:Password manager by Anonymous Coward · · Score: 1

      Which password manager do you recommend? 1Password doesn't work on my old iPad with iOS 9, so that one is ruled out. Besides, I'd rather pay for a password manager than use a free one because 'free' means: "We know exactly which websites you visit and will sell this data gladly to everybody we meet."

      Apple's. (Safari's) Since my computer is Apple, pretty sure Apple would already have access to this info anyway, so I'm minimizing the number of systems I'm obliged to trust.

      If you are interested in maximum security and privacy in your online doings and your life, follow these simple steps and practices... (note that the degree of security and privacy goes up as the list proceeds, but at the same time they also get to be increasingly impractical for most people to do, and especially to have something resembling a useable internet surfing experience if you do them):
      1. Don't use your any part of your real name in your user name.
      2. Give a bogus name when you sign up rather than real.
      3. Give a bogus DOB if they demand one, (you don't need to know when I was born, this is just so you can ask and I can tell you; I keep a copy of what I told whom (and redundant backups) so if they ever ask, I can retrieve the info).
      4. Use this user name (and the password assoc. with it) on ONE. WEBSITE. ONLY. Create alternates for each other website or service you use, in no way resembling or related to each other.
      5. Use a unique e-mail address when you sign up for the account in question, so that any e-mail address you have is only associated with one thing.
      6. Change passwords regularly.
      7. Start a business in Delaware and use THAT to form shell companies, and use THEM for things like getting PO Boxes and for leasing or renting apartments and/or vehicles... okay, admittedly, we've gone from reasonable to batshitcrazy levels of security, because... yeah.
      8. burn off your fingerprints and have your irises surgically removed, and get plastic reconstructive surgery every two years to alter your appearance, then start an underground boxing club with a set of rules all members are obliged to follow, the first two of which, (redundantly,) are both that you can't discuss the club in question with anyone.
      9. Move to a tropical rainforest jungle and live in a cave, as a hermit, have your voice box removed, and never speak to anyone again.
      10. Die. No one will every bother you again, or at least if they do, you won't care.
      Oh, and 11... when posting inane shit on slashdot, click "Post Anonymously".

    3. Re:Password manager by tsa · · Score: 1

      I have no idea what you are talking about. I'm a chemist, not a computer scientist.
      Can you explain?

      --

      -- Cheers!

    4. Re:Password manager by Hallux-F-Sinister · · Score: 1

      How about client-side salted hashes? Nobody can randomly guess something like 63DA4171F2D985441F1AE0C4F3C2AA27 as a password.

      If you salt your hashes too much, you do run an increased risk of hypertension, stroke, and even death. Word to the wise. ;-p I know they taste better that way, but it's important to exercise restraint. Instead of salt, (or in addition to a pinch, in proper moderation,) if you add some freshly ground black pepper and some butter... mmmmmm.... what were we talking about again?

      --
      Our reign has gone on long enough. Indeed. Summon the meteors.
    5. Re:Password manager by Bongo · · Score: 1

      Heh, but the salt thing is old and wrong. Salt as much as you like.

      The cult TV series Babylon 5 called it back in 1996 or something.
      And kudos also to South Park for flipping the food pyramid, around three years ago.

    6. Re: Password manager by Zero__Kelvin · · Score: 1

      That is not true. There are sites run by true security professionals, and my research indicates this is one of them. The fact that Mozilla is partnering up with them would tend to reinforce that conclusion. See also the EFF site. Surely you don't think the EFF is selling your data?

      --
      Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
    7. Re:Password manager by higuita · · Score: 1

      https://github.com/simu/passwo...

      store a key, memorize a password and that is mostly it, a different password for all sites that you don't even need to store

      --
      Higuita
    8. Re:Password manager by Anonymous Coward · · Score: 1

      That escalated gracefully.

    9. Re:Password manager by chrish · · Score: 1

      I used to use LastPass, then I switched to EnPass, which I like a lot.

      EnPass is free on desktops, has a reasonable one-time fee on mobile (once per mobile OS), and lets you store your encrypted password blob on your choice of several cloud providers. All encryption/decryption is handled at the client end, so the cloud folks can't access your data at all. They're using AES-128 or AES-256 (can't remember off-hand).

      KeePass would also be a possibility, but I found the clients harder to use than the EnPass client. The last time I tried to use KeePass, the Mac experience was pretty awful (the Mac client was a Mono app)... that may have changed. KeePass is nice because it's open source, if you're inclined to tinker or audit.

      --
      - chrish
    10. Re:Password manager by tsa · · Score: 1

      Finally some useful advice. Thank you Crish! Enpass looks interesting. It works on my iPad and my other devices. And it has a USB plugin option as well, which is handy. The other ones you mentioned don't work on the iPad. So I think EnPass is a good password manager for me.

      --

      -- Cheers!

    11. Re:Password manager by flink · · Score: 1

      Which password manager do you recommend? 1Password doesn't work on my old iPad with iOS 9, so that one is ruled out. Besides, I'd rather pay for a password manager than use a free one because 'free' means: "We know exactly which websites you visit and will sell this data gladly to everybody we meet."

      CodeBook is great. I've been using it since it was a Palm III app called STRIP (Secure Tool for Recalling Important Passwords. Their encryption layer is open source, and they support syncing across devices via Dropbox, Google Drive, or local WiFi. It supports TOTP 2FA and will generate Diceware/xkcd style passwords. They have clients for Windows, iOS, Android, and Mac. The desktop version also has an agent that will fill out web form fields for you.

      It's not a slick as some other password managers, but it works for me. $10 per mobile platform and $20 per desktop platform you use it on.

      Here's the iOS store page - says it still supports iOS 9.

    12. Re:Password manager by Hallux-F-Sinister · · Score: 1

      Heh, but the salt thing is old and wrong. Salt as much as you like. The cult TV series Babylon 5 called it back in 1996 or something. And kudos also to South Park for flipping the food pyramid, around three years ago.

      That's just what Big Sodium WANTS you to think. Did you happen to notice that Morton's was a sponsor of Babylon 5?!? At least I think they were... I'd heard they were putting salt in the water, so I have been thumbing my nose at them by drinking seawater instead... ("I'll show YOU," I thought,) and... my head feels funny... is it like, really bright in here? I think I'm going to sit down for a while...

      --
      Our reign has gone on long enough. Indeed. Summon the meteors.
  8. Re:l33t h@X0r suckers slashdot nerds by hyades1 · · Score: 1

    You could probably spell better if you took your other hand off your dog's dick.

    --
    I've calculated my velocity with such exquisite precision that I have no idea where I am.
  9. Great, but also annoying by ISayWeOnlyToBePolite · · Score: 2

    My mail shows up as pwnd. From the details of it, a site concerning a subject I'm not interested in, written in a language I don't speak and surely never registered with was pwnd and my password is all over the internet. Eventually finding the file where it's spread I unsurprisingly find that it's a password I never used.

    Now my mail is "hacked" on a semi regular basis as my mail adress and the password I've never used is included in what to me seems like new compilations of old pwnd's

    For not so surprising reasons my mail cannot be removed from HIBP and surely I can take one for the team, but it's still annoying AF.

    1. Re:Great, but also annoying by stub667 · · Score: 1

      Are you saying HIBP is not GDPR compliant, and refuses to remove your personally identifiable information from its database?

  10. Why are HIBP storing my data? by johnsie · · Score: 1

    Does that not increase the likelihood of my data being pwnd again? Also, are they complying with data protection laws?

  11. Re:HIBP GDPR Compliancy? by johnsie · · Score: 1

    I'm guessing they are dodging GDPR by basing their data and companies outside the EU. Facebook recently moved millions of user accounts away from Ireland to do similar.

  12. What I do to secure email by houghi · · Score: 4, Insightful

    I have my own domain name and I can have unlimited aliasses at my hosting company.
    So I have separate addresses for separate websites, companies or other situations.

    e.g. I will have bank.com@example.com, slashdot.org@example.com, spamaddres@example.com, holiday2018@example.com.

    So if bank.com sends me an email, it will be to the address that they know, being bank.com@example.com. If I get an email from them to e.g. spamaddres@example.com or any other address, I know it is not them and thus a fake email. If i get an email to bank.com@example.com and it is NOT from bank.com I know that they have either been hacked (and not informed me) or sold my address. Neither wil be a good thing for their further business with me.

    It is also very easy to filter as it is some sort of two factor verification where both from and to need to be correct.

    And if an email address is compromised, I can just turn it off after I have changed it at the company.

    The only company I was actually getting spam from was ebay. They gave the email address to the sellers and they started spamming me. SO no more goods from ebay for me.

    All other companies behaved till now for the last 10+ years I use this system.

    --
    Don't fight for your country, if your country does not fight for you.
    1. Re:What I do to secure email by bill_mcgonigle · · Score: 1

      The only company I was actually getting spam from was ebay. They gave the email address to the sellers and they started spamming me. SO no more goods from ebay for me.

      Add an ISO date to your format. ebay.com-20180626@example.com . Then when some random person from Shenzhen sells your address you just discontinue that one instead of quitting ebay forever. For bonus points look for that pattern in your greylister and match on today to avoid initial delay for website signups.

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
  13. WebEagle Already Scans Dark Web by NehaSen · · Score: 1

    This is a good news and good to know that Mozilla is improving. Though, WebEagle - https://webeagle.com/ has already been helping web users by exposing data breaches for a very long time. WebEagle is an integrated web technology that monitors all forms of hacking activities, dark web, underground forums of hackers and hackers' database, to notify the web users in time, if and when their accounts are hacked or their data is leaked. Uers can even buy WebEagle's securty services basis their individual requirements, wherein, WebEagle deligently scans every activity that happens around your accounts. Best, Neha Communication Manager at WebEagle

  14. Re: l33t h@X0r suckers slashdot nerds by Zero__Kelvin · · Score: 1

    Nope. I know many people who have used this site. You are wrong.

    --
    Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
  15. Stop "integrating" so much stuff by markdavis · · Score: 1

    I wish they would stop "integrating" more and more stuff into Firefox. The whole point of Firefox was to be small and fast and configurable. This is yet another example of something that probably should be an addon. Even if they BUNDLE the addon, at least it gives the option to remove it if wanted or needed for some reason.

  16. Re:Have I been Pwned is garbage by higuita · · Score: 1

    1 - not all accounts on yahoo were hacked... and i do not know if the list of hacked users was even public at any time
    2 - just because you do know some sites it doesn't mean that you were not there... some user DBs are simply stolen (like spam) or acquired when one company buys another, so you data may end in a totally different company/site that may have been hacked at sometime.
    3 - just because you were drunk when you created that myspace account and do not remember, does not mean that you had no account! :D
        more seriously, probably someone refereed your email and you got a invite... the account was half created, waiting for you to click to enable it. Even if you didn't accept the invite and have no password, there is some info about you there. EU GDPR may help you here in the future, as keeping data without user concent is a big no-no and most sites must expire and remove those temporary accounts
    4 - adobe is strange, either they got you contact via macromedia or other acquired company or you sometime entered your email to download something (even for a friend or parent)

    notice that this is not a Firefox DB, this is a DB made by a security guy that parsed all public hacked lists with users and password and created a public DB and API... if the site says he got your email from those hacks, unless there is a big bug, for sure your data was posted in some public (darknet or not) site ... if you search well, you may even find yourself. Firefox is just making easier for normal people to understand that their "reused" password is not safe anymore

    --
    Higuita
  17. Puts the ass in password by Impy+the+Impiuos+Imp · · Score: 1

    "You've been pwned! (Mealey-mouthed words about nebulous undergrounds with your email and hash or something something com-pleet something somrthing trading)"

    So...was it an ancient MMO I played for 2 months a decade ago, or is it a major email provider for my master account?

    Dunni just sign up for password1.

    --
    (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
  18. Entered my address into HIBP ... by PPH · · Score: 1

    ... and it replied "You have now."

    --
    Have gnu, will travel.
  19. Re:Fix the popup blocker by higuita · · Score: 1

    open a bug... either someone found a workaround or a bug, either way you should tell mozilla on the correct place (bugzilla.mozilla.org), not on a random site in the internet

    --
    Higuita
  20. Low quality by manu0601 · · Score: 1

    I searched my addresses with Have I Been Pwned, and I get breaches from services I never used. That sounds low quality stuff.

    The funniest point is report about password leak for an address for which the account has no password (only RSA key)

  21. Great way to collect email addresses! by sproketboy · · Score: 1

    ntr

  22. Re:postmaster @ slashdot.org by ebvwfbw · · Score: 1

    The e-mail users that I have posted to a public area are all on that list, no pastes. So they don't have my password. Same as slashdot's postmaster.