General
119 results found
-
18 votes
-
Add wildcard support for spamgourmet addresses
Spamgourmet.com allows a user to create disposable email addresses on the fly. That way a unique email address can be used for each web site you sign up for. The structure of an address is identifier[.##].username@spamgourmet.com, where the identifier can change per site and [.##] is an optional max number of emails you want to receive. Because a different address is used for each site it is currently impossible to query HIBP for breaches of all sub-addresses, like *.username@spamgourmet.com. Allowing wildcard search and notification for spamgourmet addresses (or its many alias domains) would enable users to…
34 votes -
add a timeline of breaches
It would be great to see a timeline of breaches, and a graph of the total accounts compromised (maybe separately showing the date of breach and when it was discovered/reported). I know that this year has seen a few big breaches disclosed, thanks Yahoo & MySpace, although they date back somewhat.
85 votes -
supply date of pwning in search results
When showing results of searches of pwned accounts, you should show the date of the file or hack so users can be informed whether they have changed their passwords since that date.
38 votes -
Allow a family member to accept sending notification to someone else.
For example, my parents wouldn't know what to d with this, but I'd like to add them with the option to report to me when they are compromised so I can fix it for them. Ideally, I'd add their emails and they would receive a notice to accept or deny, if they accept I get alerts on them in the future. Can optionally leave sensitive items out of report. I could also see this as helpful for consultants but maybe you could sell that. I'd actually pay for it for my parents too.
99 votes -
Domain name opt-out support
The opt-out form is only available for email addresses.
Please add support for full domain opt-out.32 votes -
Fix captcha puzzle for IE11 users
Currently the buttons at the bottom of the "check all images that have XXX" popup don't work on IE11. Can't Verify, refresh, get help, etc. Makes notifications impossible if the puzzle appears.
4 votes -
Domain wide search results - Refined export of data
It would be great to refine the export data for domain wide searches.
Something i would like to do is notify the users of new breaches. If i run the report periodically, i can easily compare the results and for any differences script a personalised mailout informing my users of such exploit.
Cheers,
Ivan10 votes -
Add a "Suspended" account button
I have been reported on 3 accounts that Tumblr accounts have been breached, one of them was in fact suspended for unknown reasons.
7 votes -
Whitelisting to filter out notification on addresses appearing in most notifications
For large companies monitoring their appearances in notifications there are public addresses (like (info|support|help|contact)@<domain> which will may mean a team receives notifications for most new breaches, but for often singular results of these 'public addresses' in breaches not of concern.
3 votes -
CSO need terms to be able to use HIBP in their company.
We have integrated HIBP api in some of our security tools in our company in order to estimate the probability of one of our client getting hacked if his email appears in many breaches.
We beta tested it, but our legal staff pointed out that we needed terms on the website to be able to use it, as the fact you only tell that you don't collect and store email that are searched (we do trust you but legal team don't work on trust :p) is not enough.
we got in touch with the french "national comity for IT liberty"…
2 votes -
Few more detail on the breach needs to be included
Need few other details on the breaches that happened in the past. Its good we get the information details completely. The same is included in http://www.askmein.com/tools/have-i-been-pwned
7 votes -
Have a page with mitigation directions for the technically challenged.
For those of us who are technically challenged, directions on how to mitigate any damage if found to have been breached. For example, my husband and I found that our Adobe accounts were breached, but we do not know when he signed up as he does not have a computer and only created an email when he got a smart phone about 4 years ago. He has no idea of how he got signed up for Adobe. To be honest, I do not remember signing up or into that service either, although I do have it on my computers and…
11 votes -
Allow root domain to verify subdomains
This idea can be broken down into two seperate ideas, I'd be happy with either.
When registering to monitor a domain that is a subdomain of another, for example subdomain.domain.com, the verifcation email should be able to be sent to postmaster@domain.com.
Allow an option to monitor a domain and all subdomains.
140 votes -
Closed EMail Accounts
Would it be possible to Register for HIBP EMail Notification via another designated EMail Address provided, to which the HIBP Notification could be "forwarded" ? ie.: Confirmed and Secure Registration under a designated EMail Address, for one or more 'Closed' EMail Addresses ?
33 votes -
Enabl API to be queried such that it returns only the breach name
At present, searching the API returns all data about the breach including description and other meta data. For high volume API consumers, it would be preferable to return just the breach name. Meta data about the breach could then be retrieved in a single API query to the breach service. This would reduce the response size for each query by more than 90%.
11 votes -
Add basic correlation logic to compare newly found pastes against current breaches...
Some sort of fuzzy matching & correlation with already posted breaches to see if the paste is just another re-post of the data from another known breach.
One way to do this is look for emails that have the + syntax, which typically means that the user has created a somewhat unique email for a particular service, company, etc
3 votes -
Summarise the breach info at the top of domain wide searches
When you search across a domain at present, the breach name is listed next to each impacted account but it's not clear when it happened or when it was loaded into HIBP. It might not make sense to list this info next to every single breached account in the list, but a summary at the top of the page listing key attributes of each relevant breach would be handy.
8 votes -
Enable search and notifications for email addresses using the "+" syntax
A lot of people use a syntax such as troyhunt+foo@hotmail.com where foo is a unique identifier for the site. They do this so that if they begin getting spammed, they can identify the source their email came from.
At the moment, HIBP treats this is a totally unique email address so if I've search for the parent email address without the "+" syntax, it won't be found. This idea is to ensure that searches and notifications recognise the syntax and return addresses that are logically still the same account.
One thing HIBP would also need to do is specify which…
2,667 votes
- Don't see your idea?