General
117 results found
-
Send enrollment email upon valid domain verification
I successfully enrolled in domain search, but never got a confirmation message. Now when I forget whether or not I've enrolled my domain in a year (as will surely happen), I have no way of knowing if I'm just repeating efforts.
16 votes -
Anonymous statistics about the collected data
Just to satisfy our hunger for data and curiosity about lists of all kinds of things, it would be interesting if the massive amount of data HIBP was processed to produce new data. It doesn't need to be searchable like Shodan's or GreyNoise's (while this would be amazing we don't need to think too much to understand the implied risks) and should not disclose sensitive information, but even with this limitation in the way it would be presented to the public (and keeping in mind the growing adoption of GDPR and similar regulations around the world), there are several processing…
4 votes -
Provide visibility of email addresses subscribed for domains
Provide visibility and manageability of email addresses subscribed for domains to ensure only appropriate people are receiving notifications.
27 votes -
Add % of p0wn count already in DB as new field in API
EG; https://twitter.com/haveibeenpwned/status/1180912324644888576 '87% of addresses were already in @haveibeenpwned'. In this case 87% of the 988k records were already in the DB. I can see the PwnCount, but not the % that was already in the DB, that's the attribute I'd like to be doing some querying on.
3 votes -
Unable to generate new api key 21/08/19
Is there an issue with generating API keys right now? I'm unable to get a key receiving an error:
An error occurred while processing your request
The error has been logged and a notification sent.1 vote -
Increase contrast in the footer
In the footer, there is the text "A troyhunt.com project" and 3 icons underneath it. These are very hard to see, especially the text. Please increase their contrast with the background
1 vote -
Report as an email containing additional details
if the email address matches the username, provide associated data elements that have been breached. These could be as follows..
1. plain-text passwords, password hashes associated with the email add.
2. other PII .. address, phone#, IP, etc.13 votes -
Filter breaches by "AddedDate"
Add a date filter to the api/breachedaccount/{account} endpoint.
In this way, we can only query breaches that were added after X date. This is helpful for notifications and reduces the amount of data we retrieve.
10 votes -
Have HIBP lookup security.txt mail addresses for Domain Search verification.
Security teams within larger and less mature enterprises struggle to achieve regular access to new breach info based on the current verification process.
Security.txt was implemented as a standard for disclosures, so it would make sense this would also be leveraged for validating domain searches by security teams. Also, would make accessing new affect users easier for larger international organizations where the DNS registration is non-standard or inaccessible.
11 votes -
Add Domain Connect to the "Verify by domain TXT record" method
This way TXT record can be added automatically at GoDaddy, 123reg, 1&1 IONOS and few others. See https://www.domainconnect.org/dns-providers/
6 votes -
Remove captcha from the domain page
Captcha is grotesequely unfair on people that have learning disabilities and is preventing me from properly using your service.
Find an anti-robot mechanism that doesn't penalise real people with real problems.7 votes -
Return usernames/email addresses with Pwned Passwords api by using a k-Anonymity model
The chances for old email addresses to be listed in a breach is very high. After some decades of use the email address occurs in a breach with a hopefully old password and is used with new passwords currently.
Thus, it would be great if I could test if a specific username – password combination has been listed in a breach. As far as I understand the API this isn’t possible at the moment.
The relating email addresses could be returned after the number of breaches in the api.pwnedpasswords.com return value. This approach has the problem that foreign email addresses…5 votes -
The ability to report data breaches
In many cases of small businesses, customers know about problems through internal emails much faster than large media. So there should be the possibility to report data breaches with sources. Perhaps with a form and in addition you can forward internal e-mails directly.
22 votes -
Add additional contacting email addresses for domain search
Add itsecuity@domain.com as one of the contacting addresses for a domain search as this is a common address these days.
11 votes -
Make domain notification more salient
TL;DR: Make domain-level notification (1) more obvious to find and (2) more salient in the registration form.
Feature not advertised in top bar labels
- "Home" promises e-mail one-time search,
- "Notify me" promises e-mail notification, not registration
- "Domain search" promises, well, one-time domain search.
I suggest you add either a separate label on top bar with a separate form. Or change existing "Domain search" into "Domain search+notification" (yes, it's longer, so see other suggestion below).
Feature not recognizable when found
On https://haveibeenpwned.com/DomainSearch there is only one salient title "Domain search / Search for pwned accounts across an entire domain". No title…
7 votes -
Indicate if the same credentials have appeared in another breach
Nice, now I know that my mail-address was included in the Exploit.In and Adobe breach. But the Exploit.In breach does not hint any clue whether we talk about the same service (=Adobe) or not. I can understand that you cannot mail me a password. After all you don't know me. I might as well be an imposter. But it would be cool if you could internally setup your database such that it outputs whether the password in an amalgamated-list-breach that did not specify a service like Exploit.In was identical to the one in another breach like the Adobe breach. That…
63 votes -
add a timeline of breaches
It would be great to see a timeline of breaches, and a graph of the total accounts compromised (maybe separately showing the date of breach and when it was discovered/reported). I know that this year has seen a few big breaches disclosed, thanks Yahoo & MySpace, although they date back somewhat.
85 votes -
Add wildcard support for spamgourmet addresses
Spamgourmet.com allows a user to create disposable email addresses on the fly. That way a unique email address can be used for each web site you sign up for. The structure of an address is identifier[.##].username@spamgourmet.com, where the identifier can change per site and [.##] is an optional max number of emails you want to receive. Because a different address is used for each site it is currently impossible to query HIBP for breaches of all sub-addresses, like *.username@spamgourmet.com. Allowing wildcard search and notification for spamgourmet addresses (or its many alias domains) would enable users to…
34 votes -
18 votes
-
Allow a family member to accept sending notification to someone else.
For example, my parents wouldn't know what to d with this, but I'd like to add them with the option to report to me when they are compromised so I can fix it for them. Ideally, I'd add their emails and they would receive a notice to accept or deny, if they accept I get alerts on them in the future. Can optionally leave sensitive items out of report. I could also see this as helpful for consultants but maybe you could sell that. I'd actually pay for it for my parents too.
98 votes
- Don't see your idea?