Question Have I Been Pwnd

[simmyx]

Anyone use this website, is it legit ?

 

[Ralston18]

If you included a link to the website, the link got lost somewhere along the way

Very unlikely that I would click the link in any case....

What is the website? Name, purpose, etc..

What happened when you clicked the link or went to the website?

What leads you to believe you have been pwnd?

More information needed.

 

[PC Tailor]

I think they're referring to this:

Have I Been Pwned: Check if your email has been compromised in a data breach

Have I Been Pwned allows you to search across multiple data breaches to see if your email address or phone number has been compromised.

haveibeenpwned.com

Not a site I use myself, but i know it's one of the most popular sites that people use to check for data breaches.

 

[mdd1963]

Not to be confused with the scam sites that politely ask you to actually enter your assorted usernames/passwords , ostensibly to look for matches from known data breaches, when in fact said user is now giving out his/her login data on silver platters under the guise of a 'security check'.

 

[britechguy]

The site referred to by @PC Tailor is definitely legit and it, of course, requires you to enter the e-mail address which you're trying to check. Anything that would ever ask for a password entry should be setting off anyone's "Run, RUN, RUN away!!," reaction, which they should actually follow.

Having been pwned is not the end of the world, either. I've been part of the Anthem and Equifax data breaches, and that means that two of my e-mail addresses have been pwned. I'm not about to "panic close" every e-mail account that this occurs on. The idea that anything is "totally private," and particularly e-mail addresses which float around in the cyber atmosphere for virtually anyone to see, has never been true. Changing one's password and using something that's "sufficiently secure" is more than enough caution.

 

[britechguy]

By the way, to be completely clear about what I said above, the RUN reaction should be if a combination of e-mail and password are requested in tandem with each other.

The HaveIBeenPwned website does include a separate search strictly for passwords, but asks nothing related to e-mail addresses or other account information in conjunction with the check. Obviously prior data breaches involve full account information, including login and password, but if each is separated from the other you're not giving anything away, really. In addition, the whole point of that site is to tell you whether you need to change either the password you're using for a given account, or whether to ditch a given password separately from any account because "it's made the rounds" secondary to a data breach. Those passwords will be used in brute force attempts to get into accounts, and if yours happens to use it, and your account information is out there from a breach, then the two could easily come together.