Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?

Question

There's a lot of news right now about haveibeenpwned but I don't understand why people need a service like that in first place. If you're a security conscious user, you'd change your passwords regularly on any website that matters (banking, email, paid services) and thus leaks would not affect you in the first place. By 'changing your password' I refer to creating a randomly generated password string for each service, not the enforced changing of passwords in corporate environments.

So why are people so interested in using haveibeenpwned? Why not follow the right security practices regardless of any leaks?

Answer 1

All the other answers talk about what best practises are. But let's take the question at facevalue: "Why do people not use best practises (whatever they may be), and instead use this website".

The biggest problem in security is the human element. It's human nature. To improve security you have to take it into account.

You write in the question: "A security concious user would", but then you ask "why are people so interested in using haveibeenpwned?". Well, thats because a lot of people who are interested in the service are NOT security concious. Maybe they are somewhat concious, maybe they have just heard on facebook about this neet website.

If I tell my mom to "follow the right security practices" (and explained them) she would do nothing.
If I tell my mom to check that website for the one password/email she uses everywhere, and it shows her that it's compromised, she will probably atleast change it once on important websites.

In the end it's a tradeoff for the user.
If he never had an account hacked and felt the impact he will see the risk as very low, and the cost to follow best practises as very high.
Checking haveibeenpwned on the other hand is very low cost. And checking it in and of itself gives you a better risk assesment. If you are compromised you now know that the risk to you is high, so it's more likely that they will follow better practises after visiting the website.

So, it's easier and more convienient, and therefore more likely to go viral. This is something I can share, and security illiterate people can use and feel good about and share too. It's also a gateway to good security practises.

Answer 2

Your question contains several false assumption:

• If you're a security conscious user, you'd change your passwords regularly on any website that matters

According to my password manager I have more than hundreds of accounts and most of them would do harm to me if compromised. Changing all of them regularly (like every 90 days) is a huge amount of work. So I use strong passwords generated by the password manager instead. But some services still save passwords in clear text.

• and thus leaks would not affect you in the first place.

Let's say I would change every password every 90 days. There is still the possibility that there are 89 days where my account is compromised and the attacker has time to do anything including changing my password. When you know your account is in the list, you can act instantly.

• Why not follow the right security practices regardless of any leaks?

See previous point.

• So why are people so interested in using haveibeenpwned?

To know which accounts are affected and to figure out which service got hacked/where the accounts came from.

With this knowledge:

• I can change the password instantly.
• I know which service is less trustworthy for sensitive data, money, ... and I might close my activity at this service.
• If this service has a messaging system I know to be more alert of messages from "friends" because the account might be stolen.
• I know which of my data might be compromised (data at the hacked service).

Answer 3

Changing passwords often is not considered a best practice anymore.

People are interested in HIBP because it centralizes information regarding breaches and makes it easily accessible. Not everyone is a security conscious user, but the information is valuable to all users because regardless of your password age practice the password should be changed immediately upon knowledge of a breach.

Answer 4

Changing passwords regularly actually tends to reduce security, as people end up using repeated patterns.

The recommendations are to use strong passwords, unique to each service, and only change when a compromise is suspected.

HIBP gives that notification of compromise.

Answer 5

It comes in handy when your email address has been exposed but not as part of a credentials set. As an example, I had an email address included in a breach but I didn't have an account with that service/product, the breach was actually on a marketing tool used by a service/product that I was using and my email address had been added to the tool for marketing purposes.

Knowing my email address had been exposed in that way, I knew to keep an eye out for increased spam and phishing attempts.

Answer 6

There's an option to monitor entire domains. This is very useful as not everyone in the company are equally aware nor cares as much. With such notification, as an administrator, you can e.g. force additional password changes for users with new leaked passwords.

Also, increasing awareness is important in itself.

Answer 7

Why not follow the right security practices regardless of any leaks?

Because regularily changing your passwords is not a right security practice. It is a hack and work-around.

The proper security practice would be to change your password whenever you have reasons to believe that it has been compromised. I've had root passwords unchanged for a decade because there was never ever any reason to suspect a compromise has occurred, so it would have been a nonsense to create the cost of a password change (however small) for no reason.

The advise to regularily change passwords is what we use when tracking possibility of compromise becomes difficult or expensive, and regular changing is simpler and cheaper than that. Basically, the reasoning is: "If I don't have a clue about the probability of my password being compromised, I'll just take a statistical average and err on the side of caution".

So when actual evidence - such as havibeenpwned - appears, it is always preferable to use the actual data over any guesstimated heuristics.

---

addendum:

If you search a little, you can find plenty of publications advocating against regular password changes for no good reason. Disclaimer: Some of them are mine. This nonsense might be a common practice, but that a) doesn't make it a good practice and b) still doesn't mean it can hold a candle to actual data.

Answer 8

Changing passwords often can be good practice if you use a password manager. If not, it's a bad idea because you can not remember good passwords that easily.

A minority of people use a password manager. And even if you do use one, I suspect you don't change all your passwords that often. There are services I use once every two or three years. Or that I created an account for but might never use again. Would I go back there and change my password every month?

I have 50+ sites listed in my password manager. Changing all those passwords every month or so would just be to much work.

Answer 9

To protect yourself against fraud

There's an alternative consideration I notice people haven't covered, one of which is identity fraud and impersonation of the compromised company, something of which changing a password will not protect you from.

For example, it's common for scammers to harvest leaked information and then pretend to be the company whose information was leaked by using the information they've obtained to convince you they 'legitimately' have access to your information. The ISP TalkTalk often sees scammers phoning up, pretending to be TalkTalk service engineers, regurgitating the stolen information as 'proof' they're authentic.

Likewise, being aware of which companies have had their details stolen allows you to be aware of which vectors scammers will try to use against you. For example, details for Adobe have been stolen, and it's quite possible a scammer could mail people whose accounts were on Adobe, a supposedly 'urgent update' to their Adobe software, that actually maliciously downloads and installs malware. Being aware that information has leaked from Adobe allows you to take additional precautions against that.

An alternative is if leaked information is about an activity you'd rather not have made public; you can then take reasonable steps to have that information scrubbed (such as deleting the account or changing email addresses).

So in summary; you would regularly check to make sure you know what other people (EG scammers, identity fraudsters, blackmailers etc) know about you.

Answer 10

I will go against the trend here and disagree with the other answers:
You should regularly change your passwords on a service that you do not trust to handle your data securely.
You can also regularly check your password manager for such sites and decide if you really need every one of them. If not: send an email to the service provider and ask for deletion of your account and all affiliated data.

The NIST guidelines that handles password states:

Verifiers SHOULD NOT require memorized secrets^{read: passwords} to be changed arbitrarily (e.g., periodically). However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.

Collection #1 - which is the reason for the recent buzz around haveibeenpwned.com and Troy Hunt - is an excellent example for the publication of evidence of compromise.

Why? Because it is not a new breach.
Brian Krebs, renowned security expert published a report, that claims, that all the data in there is at least two to three years old. His report furthermore contains this picture from a credible chat with a seller. A screenshot of all the other "Collections" (one through five) and two other huge databases that are sold with the claim, that they are full of working login credentials. All in all a terrabyte of raw data from one seller.

So what does "non-public publication"-age mean in this context? If you have a strong password and it is properly hashed, then no attacker will be able to crack it, no matter how long the password dump has been around. The problem is, a lot of sites do not properly hash your password. And here is where the NIST comes in again. They adapted their guidelines towards changing passwords, because it made no sense in respect to the part of the guideline that handled hashing passwords and storing hashes.

Verifiers SHALL store memorized secrets in a form that is resistant to offline attacks. Memorized secrets SHALL be salted and hashed using a suitable one-way key derivation function.

So what does it all mean?
Conclusion:

1. Premise 1: If a service is storing my password hash securely, arbitrary expiration dates of a password do not make much sense.
2. Premise 2: Hacks happen all the time, only a fraction get noticed and/or publicly disclosed.
3. But if a service does not hash your password properly - and a LOT of services do not do that - expiration dates of passwords do make sense.
4. How do I know which service stores my credentials securely? Some certificates give you some information about it. But even companies that seem very professional from the outside fail hard. Small companies perform very nicely sometimes. It's very hard to tell.
5. If hacks happen all the time, password breaches happen very often as well. As we have seen only a portion of the hacked password databases are searchable on haveibeenpwned.
6. So change your password regularly on sites you do not trust. Again with the caveat that you should use a password manager to avoid password reuse and if possible 2-factor authentification or multi factor authentication.