Feeds

Has your account been pwned? New website will tell you

If you trust it with your email address

5 things you didn’t know about cloud backup

Security researchers have set up a website that allows punters to check whether or not their email addresses have appeared in data dumps slurped from compromised databases.

Hacking attacks on sites including Gawker and the network of Sony's gaming division have led on to the publication of hundreds of thousands of users' credentials online, sometimes (but not always) by activists at Anonymous.

That's bad enough in itself but is even worse for users use the same login details for all their online activity - from email to online banking. Compromised firms normally make some effort to notify affected customers but this does not always happen.

A new site - called Pwnedlist.com - aims to plug this information gap. Users enter a username or email address into the site’s search box to find out if their username has appeared in any recent public data dumps. Users are not prompted to enter their password itself.

If a username or email address appears on the list, users are advised not to panic and to simply change their passwords. There's also sensible advice of offer on password security even if credentials are not on the list.

The service includes five million records and was established by Alen Puzic and Jasiel Spelman, security researchers from DVLabs - a division of HP TippingPoint.

"Data entered is not stored, re-used, or given to any third parties," the terms and conditions of the site explain. Tech savvy users can submit a SHA-512 hash of their email address or username as input instead of the plaintext version.

Puzic and Spelman explain the pwnedlist project, and how they would like to develop it, in an interview with KrebsOnSecurity.com here.

Pwnedlist.com is nicely done and serves a useful purpose, for example, in cases where net users needed proof that their online identity has been compromised.

However any similar services that crop up might not be so well done: encouraging users to hand over even part of their logins credentials to supposed security checking sites is not necessarily good thing, Carole Theriault of Sophos notes.

"These types of service could also raises a concern: what is to stop a malicious site, masquerading as a helping hand, request usernames (or even passwords) from internet users? Indeed, we have seen many nasty sites pretend to be legitimate or reputable over the years," Theriault writes.

Theriault concludes that if users even think their logins might have been compromised they ought to change their credentials, whether or not they are able to confirm that they have indeed been pwned. She concludes with some password tips of her own in a blog post here. ®

Next gen security for virtualised datacentres

More from The Register

next story
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
Germany 'accidentally' snooped on John Kerry and Hillary Clinton
Dragnet surveillance picks up EVERYTHING, USA, m'kay?
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.