0

I've been using Chrome to save and sync my passwords across devices (and lately I am trying to switch to Bitwarden). Google warned me recently about a password I have used across multiple sites that have been found in data breach. However, if I check that password in HIBP it does not show up.

How could I find out which site/data breach was that?
Can I trust Google that there was really such a breach, not just warning me being silly for using a short password?

dragi
  • 101
  • 2
  • 2
    HIBP is just a service run by Troy Hunt. He doesn't search for breached data himself but people send him stuff. He also takes time to verify breaches before posting them. Google may have different sources, or may be faster at verifying. – Fire Quacker Jan 26 '22 at 21:48
  • 1
    Comparing the [non-exhaustive list](https://support.google.com/accounts/answer/9457609) of breaches Google uses to [HIPB's list](https://haveibeenpwned.com/PwnedWebsites), there are at least a couple of unnamed breaches ('1.4B collection` and 'Collection 1-5') and one named breach ('VN') in Google's list that I cannot match to anything in HIBP's list. It may be from one of those, or from somewhere else entirely. – nobody Jan 26 '22 at 23:31
  • 1
    @nobody That's probably it. After Troy added Collection #1, there was a deluge of massive data troves being passed around, which he wrote about in this article: https://www.troyhunt.com/the-race-to-the-bottom-of-credential-stuffing-lists-and-collections-2-through-5-and-more/ He decided not to load Collections #2-5 partially because they had no context - just a heap of information. Troy prefers discrete breaches where the site is known. If the OP's email is in one of those more broad collections, then there may never be a way to know what site it was originally from. – Fire Quacker Jan 27 '22 at 00:39
  • @nobody Thanks! I guess that would answer my question as far as currently possible. Could you post it as an answer? – dragi Jan 27 '22 at 14:34

0 Answers0