On: Check if your email is amongst those compromised in Gawker break-in

[jedsmith]

What is the point of including the domain tied to the address? It just decreases the anonymity of what you've hashed, and actually does a disservice. There are corporate domains in there and the namespace of what to search for becomes a lot smaller.

In addition, my domain is my name. I saw many others in the file that this was the case for. It's not a big leap to compute my e-mail from 'jedsmith.org', and I'm sure it isn't for those guys either. You're leaking data with this view.

Here's a version that is far more anonymous (and easier, I think): http://undertow.jedsmith.org/gawker/

[abraham → jedsmith]

Why even bother hashing the email addresses when the entire dump can be downloaded with bit torrent.

[jedsmith → abraham]

Because I'd prefer not to help distribute the leaked information? If you want the information, nothing stopping you from getting it, true. However, me throwing up an entire list of e-mails just adds to the problem.

[ig1 → jedsmith]

Any one with ill intent will have already downloaded the full unanonymous file.

[jdludlow → jedsmith]

I like it.

OS X users, if you are paranoid about using online tools for the SHA-256 hashing, you can do this from the command line with sha256deep.

Via Homebrew it'd go like this (replace the 1st step with whatever package manager you like):

$ brew install md5deep

$ echo -n my@email | sha256deep

d869524229c1e2f6139194fee1aac14f873b008dd0279458cbdfb6b3fbade1d2

[sirn → jdludlow]

…or without installing anything:

    $ echo -n 'my@email' |openssl dgst -sha256
    d869524229c1e2f6139194fee1aac14f873b008dd0279458cbdfb6b3fbade1d2

[jrmg → sirn]

Or, with the cryptically named 'md5'...

    echo -n 'my@email' | md5

[chrisbroadfoot → jrmg]

md5 != sha256

   $ echo -n 'my@email' | shasum -a 256
   d869524229c1e2f6139194fee1aac14f873b008dd0279458cbdfb6b3fbade1d2  -

[jrmg → chrisbroadfoot]

Ah - true - we're talking about different things though (which is my fault to start with, but I see confusion in others too).

MD5 is what's used in the linked spreadsheet's email address fields, which is what I thought we were talking about. SHA-256 is used in jedsmith's lists.

[izak30 → jdludlow]

Also

python

>import hashlib

>hashlib.sha256("you@yourdomain.com").hexdigest()

[wizardishungry → jdludlow]

The hash is md5 not sha

[jedsmith → wizardishungry]

He's referring to using mine.

[metageek → jedsmith]

I found it useful because I use site-specific email addresses (as in username+domain@example.com). I didn't know if I had a gawker login, so I searched for my domain. If I hadn't found it, I could've saved myself digging through my saved email.