General
189 results found
-
Notify me of specific site breaches?
I'd imagine I'm not the first to ask about this but can't see it listed. If I have an account with a site, say the BBC site, can I sign up to be informed of confirmed data breaches even if my particular email address is not in a set of compromised data? Apologies if this already addressed - point me to it.
1 voteThis would effectively amount to a per-individual corpus of sites to be monitored which really isn’t something I want to maintain in HIBP. If you have an account with the service and you’re subscribed to notifications, you’ll be notified anyway if it appears in a breach.
-
Fix Email verification
FIx your email verification process. Years back people reporting that emails are not received, IT people watching their email logs confirming nothing is received from your site. Today I am in same boat yesterday and today been trying check email logs at smart host/filter and O365 and neither has any sign of your verification email. There is an issue unfixed you need to resolve.
1 voteEmail delivery checks out just fine: https://www.mail-tester.com/test-difjlr0tj
Talk to your provider if you’re finding it blocked,.
-
Remove password which is pwned on small and don't see in long time.
First time i have check my password, it was not pwned.
Second time, just after first time some days, it was pwned with "seen 1 time before".
This is no problem until now, but when github start using your api to check password and force i give up my good password!
So please remove password which "seen 1 time before", or at least make a feature that auto remove password from your database if it is not pwned or less pwned in long time.3 votesThat’s not a reason to remove the password, that’s a discussion you should have with GitHub about what threshold to block a password at.
-
Add incremental updates to the PWNd password data sets
While it wouldn't preserve order, generally, it would greatly reduce the burden on people downloading those data sets for their own use. It has the potential to drastically reduce the bandwidth costs for the system as users would likely download the bulk of the set just once and then get the updates thereafter.
1 voteThis isn’t feasible as each incremental update doesn’t just add new passwords, it updates the counts on existing ones too. Better just to use the k-anonymity API.
-
Email reminders for varification
After the second or third reminder the last one does not contain the email address any more in the text. My improvement: Add the mail address as in the other reminders for a better UX.
1 voteThis is intentional to change the format slightly in the hope of not being flagged as spam.
-
You are compromising the security of the people
Regarding the recent Ledger data breach, anyone that types a compromised email address knows that he/she has a ledger wallet and crypto. You are leaking to everybody the same information leaked by the hackers and you are compromising the security of that person by revealing the email, exposing him or her to phishing attempts and even to physical risk if the person that performs the search knows the identity of the owner. This is a very serious issue. Please consider sending the results only by email at least for these most serious data breaches where there is physical risk for…
0 votesThere are many, many very good reasons why the service operates in this fashion: https://www.troyhunt.com/the-ethics-of-running-a-data-breach-search-service/
-
I suggest adding a date stamp so we can see when info that's pulled up in a search was last updated.
1 voteBreach data remains largely unchanged after load. Create and modified dates are available via the API if you want more granular data: https://haveibeenpwned.com/API/v3#AllBreaches
-
Give us if our email is likely to be pasted.
We should be told if a hacker can still access our email or paste it. We should be told that once we receive our results,
2 votesThere is no way of knowing this.
-
Describe why a search of an e-mail address using the form and API return different results
If I search for my work e-mail address on the web page, I get no results. However, if I search for my work e-mail address with the API I get two results.
Why is this different?
I am suspecting that the lack of passwords in the breach constitutes not being pwned?1 voteSounds like you’re not using the IsVerified param correctly on the API.
-
Showing results via Mail
I think it is a matter of privacy what services (that were breached) I used. This site allows me to type in any e-mail I know and to verify whether or not the person did use a special service. It might seem that this information is not too big of a deal, still I'd consider it private. So my suggestion is that the services only sends back a link to the email that shall be checked and provides the results there.
14 votesThe reasons for the current approach are detailed in this blog post: https://www.troyhunt.com/the-ethics-of-running-a-data-breach-search-service/
-
Allow users to login and mark breaches they dealt with
My data was in the 500px breach. Every time I check for breaches against my email address on HIBP, this comes up. I use random passwords so I am not concerned about the leak, but I do make sure to change passwords once I am notified of a leak. Once the list of breaches becomes long enough, I may not remember whether I have dealt with a specific issue reported. It would be good to have a mode where I can log in and check the issues that I have dealt with, so the next time I login and check…
1 voteHIBP is not intended to be a personal triage tool, it’s a reflection of breaches at a point in time.
-
Cit0day - is it possible to include the site(s) whose lists an email appeared in?
In the alert email for the Cit0day breach, the only information provided is that one's email appeared somewhere in the breach of the 23k websites. If it's possible, it could be helpful for users to be informed of which specific site(s) their credentials were listed under.
I fully grant the larger point about encouraging the use of a password manager to mitigate the risk regardless. Thanks! :)
3 votesHIBP only matches an email address to a single “breach” (which is what the Cit0day collection is treated as) and doesn’t have a provision to add any additional data such as which file the email address appeared in.
-
Send me the data, not just the site name
When you find my email in a breached site and on a list somewhere where you say that my email and password were found, send me the details (i.e. the password or hashed password) so I can decide whether I need to change my password. I use a different password at every site. So knowing more than just my email was found a list would be useful.
1 voteHere are all the reasons I don’t make passwords available via Have I been pwned: https://www.troyhunt.com/here-are-all-the-reasons-i-dont-make-passwords-available-via-have-i-been-pwned/
-
1 vote
This is not feasible for the reasons mentioned here: https://www.troyhunt.com/the-ethics-of-running-a-data-breach-search-service/
-
Help victims of cyber stalkers
I have a friend who is being absolutely terrorized by a computer savvy guy who is backhandedly threatening her life, posting her real name on adult websites, hacking her voicemails, opening accounts with her information and we believe he has now shared her info on some dark web place allowing other hackers access to her information. We have made police reports and even contacted the FBI cyber crimes unit. But this guy is using VPN’s and change your number apps. He calls and harasses her constantly, for over 4 months now this has been going on. I heard about this…
1 voteThis is not a feature suggestion for HIBP.
-
Add as a FAQ how Pwned Passwords aligns with Google's new Safety Check
Google now detects some email / password combo breaches. Google doesn't have any more detail on when / what / where. What might explain any difference w Pwned Passwords?
3 votesTotally different services, I’m unsure whether Google uses and data from HIBP or just sources it all themselves.
-
Filter known breaches and pastes in the API
It would be nice if we could pass a set of breach names into the https://haveibeenpwned.com/api/v3/breachedaccount and a set of paste data into https://haveibeenpwned.com/api/v3/pasteaccount and have them only provide results for the breaches and pastes not on the list, basically something like ?exclude=thing1,thing%20two for breachedaccount and something like ?exclude=%7B%22PasteBin%22:%20[%22123%22,%22456%22],%22Pastie%22:%20[%22abc%22]%7D for pasteaccount.
3 votesThat sounds like something you could easily filter on the client end: request the data for an account then remove all items that don’t match what you’re looking for. There’d be no performance benefit doing it on the HIBP end as the query presently just picks up an entity (the account being searched for) and returns it in its entirety.
-
Fix QuinStreet information
QuinStreet is not an online service, it has leaked my info it must have accuired from buying it from other companies that I do not know who is. They have no login that can be fixed. Firefox Monitor uses your service to alert for this company, but as is it makes little sense to present it as a web service I have signed up for.
1 voteI can’t see anything in the submitted idea to suggest the description is incorrect.
-
improvement on awarness and great feature
It would be better if u also added the info about which site leaked our data, no need to give passwords...
It would encourage us to let our friends know about it if they used the same website and create a lot more interest and awareness all around.
I know this data(which site leaked it) might be hard to get and might be rarely available .You might know only few of thosee.But still ,a start in this direction might be lovely and show to other people that u dont know where the leak came from...they might help u provide the…1 voteHIBP already tells you which site leaked the data, it appears immediately after performing a search.
-
Option to return "no breaches found" in json body, rather than simply a 404 status
It would be good to be able to return something in the json body when no breaches are found for an account.
A parameter to enable this message would be great.
I'm working with a 3rd party software to pull data, and doesn't expose the status in an accessible way.(I would have thought a 204 status would have made more sense?)
1 voteHTTP 404 is the semantically correct response code, there’s no reason to include anything further in the body. Sounds like a deficiency with the product you’re using if it’s unable to interpret response codes correctly.
- Don't see your idea?