It's amazing. Just about every single one of my email addresses have been compromised in one way or another, how could it be there are so many websites with such bad security.

Because security is actually really hard, contrary to popular opinion.

As an industry, I think we need to rethink the way we develop, package, and deploy web apps. The fact that we rely on individual developers and sysadmins to get security right, perfectly, every time is crazy. In an ideal world the prod environment should protect me from shooting myself in the foot, and the OS should be running a hardened-by-default, single-purpose system image that doesn't require bespoke knowledge to make secure.

While far from perfect, I think the PaaS vendors (AppEngine and Heroku) got a lot of things right in this regard. [Disclaimer: I work for Google, but not on Google Cloud.]

> Because security is actually really hard, contrary to popular opinion.

But some of the password hashing algos used, no salting, making all password characters lower-case in the background, etc. are not hard things to avoid. So when a site is hacked and the user information stolen and we find that stuff out, it's safer to assume other security practices where also subpar.

Yup there are just a lot of bad developers out there, quite honestly.

For big sites, I have a hard time blaming it on a bad developer. Early in my career, I worked for a company that stored it's passwords in plain-text. I suggested on many occasions stop doing this and was always told no because the site had an older audience and they wanted to make it easy to send password reminders, which also meant they were emailing passwords in plain-text. This came from the tech director and CEO and none of the other devs seemed to care.

A few years after I left, their DB was compromised, so someone got a list of email addresses with clear text passwords.

Add "cheap" to their traits, and it would help figure out why anybody would ask them to code anything

No. Most vulnerabilities are sql injections and phishing attacks. There are so many leaks because incompetence is the norm among developers.

That site is amazing, I can look up anyone's email address and see what hacked communities they are a part of

Unless they use different emails for different websites. This sounds extreme, but you just pointed out one reason that might be a good idea.

And other reasons include:

Knowing who leaked your email or sold it to spammers

Being able to stop spam by deleting the email

You could even consider binding the email to a domain so the address would only accept emails from the domain you gave this email address.

You don't really want different mailboxes, you want one mailbox with different aliases. An alias becomes a "communication token" which can be revoked, very much like when paypal gives a payment authorisation token to an ecommerce website. If that token gets leaked, no big deal, no one else can use it. A single email address is more like a credit card number.

Try <username>+<per_site_suffix>@gmail.com and then set up a filter for every suffix.

The per_site_suffix can be anything you want.

Except that everyone does that, I am sure spammers very well know that suffix trick.

Well, the data is already on the internet...

it is more convenient, just upvote and move on

According to this site, the Myspace data set contains a profile with an email I wasn't issued until 2012. So my university reissues emails. So I could probably throw it into a bunch of "recover password" forms. That kinda sucks.

So when my email gets reissued i'll have to track down every single website it's linked to and purge any personal information etc. Fantastic.

You should push for them to change that practice. If your e-mail address isn't permanent, you probably shouldn't register it with other sites, or else track every site that uses it for authentication (account recovery) so you can update to your new e-mail address when you move on.

Out of curiosity, what do the usernames (aka local part) of the e-mail addresses look like? Are they based on names/initials? Are they arbitrary?

The format is `${firstLetterFirstName}${lastName}${int}`.

My high school followed a similar structure, but had the graduating year as a suffix, implying that they would never be reused.

I wouldn't be surprised if this was rampant in educational institutions who have to provision emails to people with identical names all the time.

why not use a sub domain? [email protected] for example.

most universities where I live use either stu120691 [at] mail.uni-kiel.de, or stu120691 [at] informatik.uni-kiel.de, or allow you to choose a custom prefix for prefix [at] stu.uni-kiel.de and prefix [at] informatik.uni-kiel.de

(those addresses are mine, first the generic ID, then the generic ID [at] faculty, then prefix [at] generic (I don’t have one), then prefix [at] faculty; first comes first serve on prefixes)

or a Gmail wildcard alias [email protected]

I've never signed up for myspace, and yet it tells me one of my emails is compromised there.

I'm not sure what to make of that information, since I know it's not a recycled email address.

That site is amazing and it is shocking how many of my emails have been compromised by random games I've played.

For example, D&D Online and Heroes of Newerth both were compromised.

Here's my question...what recourse is there beyond resetting passwords? If a company did something as dumb as store my PW in plaintext, do I have any realistic legal recourse for what seems pretty negligent? I'd assume I'd have to prove damages of some sort, and I am not a fan of an overly litigious society, but it seems there is no real recourse for impacted users.

TOS's generally protect the company's I'd imagine. (IANAL)

Just got an email today from the same site that I am in the leaked myspace dataset. Is this a new dataset or else why are they notifying me only today?

http://www.businesswire.com/news/home/20160531005770/en/Time...

The dataset was hacked years ago but only recently the data from that hack was openly available for sale which poses a significantly higher risk.

The dataset was just leaked yesterday or something. The data in the leak is from around 2008 I believe though.

This has reminded me to sign up all my emails for alerts, and makes me glad I started using Lastpass back in 2012 and almost all my logins these days are separate and very long passwords.

Which is great until your Lastpass account gets hacked.

There is no such thing as unbreakable security. You always have to compromise security for usability somewhere. I trust LastPass' procedures more than I do most websites'.

While I agree with you, Lastpass has been hacked in the past, and if you store all your passwords in one place it's really open-kimono time when there's a breach.

I've taken to doing the thing they tell you never to do: I write my passwords down on a piece of paper. Criminals can get access to my passwords, but they're going to have to travel to my house to do it.