Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5359 > unrolled thread

haveibeenpwned -> submit@bugs.debian.org and others

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  haveibeenpwned -> submit@bugs.debian.org and others Davide Prina <davide.prina@gmail.com> - 2018-01-06 17:20 +0100
    Re: haveibeenpwned -> submit@bugs.debian.org and others Noah Meyerhans <noahm@debian.org> - 2018-01-06 18:40 +0100

#5359 — haveibeenpwned -> submit@bugs.debian.org and others

I have try this site:

https://haveibeenpwned.com/

that inform you if your credential have been compromised in data brench 
(only for public compromised data).

I have try it with submit@bugs.debian.org and this account result 
compromised!! for: Email addresses, Passwords, Device usage tracking 
data, Names, Physical addresses

Have this address a password?
Can this be a security issue? (If this is not know and the password was 
not changed)

I have see that also other Debian mail result compromised:
security@debian.org
debian-security@lists.debian.org
request@bugs.debian.org
listmaster@lists.debian.org
debian-devel@lists.debian.org
debian-project@lists.debian.org
debian-security-announce@lists.debian.org
debian-i18n@lists.debian.org
debian-italian@lists.debian.org
debian-l10n-italian@lists.debian.org

Ciao
Davide

[toc] | [next] | [standalone]

#5360

[Multipart message — attachments visible in raw view] — view raw

On Sat, Jan 06, 2018 at 05:10:10PM +0100, Davide Prina wrote:
> https://haveibeenpwned.com/
> 
> that inform you if your credential have been compromised in data brench
> (only for public compromised data).
> 
> I have try it with submit@bugs.debian.org and this account result
> compromised!! for: Email addresses, Passwords, Device usage tracking data,
> Names, Physical addresses

Thanks for your concern. However, I suspect it's misplaced in this case.
haveibeenpwned.com works largely by indexing and scanning public text
sharing sites like pastebin.com. Given the nature of
submit@bugs.debian.org, it's fully expected to show up in lots of
content on such sites.

> Have this address a password?
> Can this be a security issue? (If this is not know and the password was not
> changed)

submit@bugs.debian.org is not an email account with a password, so
there's no risk of password compromise.

> I have see that also other Debian mail result compromised:
> security@debian.org
> debian-security@lists.debian.org
> request@bugs.debian.org
> listmaster@lists.debian.org
> debian-devel@lists.debian.org
> debian-project@lists.debian.org
> debian-security-announce@lists.debian.org
> debian-i18n@lists.debian.org
> debian-italian@lists.debian.org
> debian-l10n-italian@lists.debian.org

What I said about submit@bugs.debian.org applies equally to these
addresses as well.

noah

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web