Skip to content

General

183 results found

  1. GDPR

    Dear Troy,

    From the GDPR standpoint, you are in total breach and anyone that is using your service on a large scale is in breach.

    The reason is that GET instead of POST. You should NOT ask your users to submit emails by using GET but ONLY by using POST.

    Because you are using GET, ALL email addresses remain the the Cloudflare loggers and who knows what other server loggers.
    Please switch it to POST!

    Thank you for this kool service!
    Too bad that rate limiting to 1.5 seconds does not help us to deliver a service for companies based…

    3 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    From a data protection perspective (regardless of which local regulation you choose), the issue is not GET versus POST (or any other verb), the issue is where the data passes through and if it's retained. Cloudflare logs are highly transient, as are the Azure Storage logs when the underlying data structure is queried. GET is the semantically correct verb for retrieving an entity and there are a whole bunch of reasons why it makes more sense, including being able to share a link like this: https://haveibeenpwned.com/account/test@example.com


    As for the rate limit, vote on this idea, it's coming 🙂 https://haveibeenpwned.uservoice.com/forums/275398-general/suggestions/39837802-create-different-pricing-for-different-rate-limits

  2. Please reconsider posting data of the Optus hack, their competency to notify us of what info has been shared we do not trust.

    Please reconsider posting data of the Optus hack. The competency of Optus has been lacking and we do not trust them to notify us of what info has been shared. People who have questioned the information have received different results between contacting them and the emails sent out. Additionally, Virgin mobile whos customers were Optus, their data was included in on this hack can doubly expose users.

    1 vote
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  3. partner with other sites, for example hackcheck.io

    Merge APIs, More results, More Support, Etc

    3 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  4. Better way to cancel subscription

    For whatever reason, I am not receiving emails for the API Key subscription service. I have verified that noreply@haveibeenpwned.com is on the trusted senders list, is not on the blocked senders list, and have made sure the emails aren't going to junk. Unless Microsoft is blocking emails intentionally, I am not able to cancel my subscription to the API key which I no longer need (switching companies very shortly).

    Please provide a better/easier way to cancel API keys.

    3 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  5. Yandex Eda etc leaks from itarmy.to

    Add Yandex Eda and CDKK leaks from itarmy.to

    Lots of Russian users got their addresses and other very private information revealed, including many from the opposition.

    1 vote
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  6. top 1 million by prevalence

    I was thinking that you could help us host the database by offering top X by prevalence. One could then host the database within the enterprise. My simple test showed
    470K Mar 4 04:32 10K.txt
    45M Mar 4 04:31 1M.txt
    9.0M Mar 4 04:46 200K.txt
    16M Mar 4 04:48 345K.txt
    18G Jan 21 05:42 pwned-passwords-sha1-ordered-by-count-v8.7z
    The interesting part is that the prevalence dropped to below 500 at 1M records. SQLite was able to load this into a 155M database which we can easily host ourself.

    1 vote
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  7. Confused by Gravatar notification

    You tell me that one of my accounts have been Pwned through the Gravatar scrape - but i've never used it or any of the associated companies mentioned. So how would my email even be on there? And, if it is, I can't see how it could have any personal data of mine attached. Thx

    1 vote
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  8. have a way to mark all "breaches" as "rectified" when you changed the pasword.

    We all change our pw frequently... it's hoped,

    so have a way to grade the leak to "critical" before you update the pw for that breach. but then mark it as rectified after the pw is changed

    1 vote
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  9. Add database of passwords longer than 8 characters

    With the new NIST guideline of 8 character minimum password length, it would be useful to have a database of only passwords 8 characters or longer. My assumption is that this would reduce the size of the database significantly.

    3 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  10. Link Breach Lawsuits

    Link all verified mediums that one can access to join or create a class-action lawsuit/claim related to a data breach.

    3 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  11. The email addresses (2) in the LinkedIn leak are email addresses that I’ve never used on LinkedIn, but on GitHub.

    Are we sure this is a simple scraping leak? Or is something else going on here? Given Microsoft owns the two services, could it be more problematic than we think it is?

    1 vote
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  12. Note where aggregation is suspected.

    So I've just been notified about the LinkedIn "scrape" and have verified that my data predates the Forbes breach. I have used multiple emails for LinkedIn over the years, and my current email is considerably older by a number of years than the HIPB alert might suggest.

    I cannot be the first person to notice this, so it looks like this looks like some sort of peas porridge aggregation. It is notable that my current details are in the Forbes breach but the LinkedIn details are relatively ancient. I know you do not have a lot to go on for…

    1 vote
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  13. Mark the Guntrader breach as Sensitive

    The Guntrader breach should not be publicly visible as the severity of that leak comes from it revealing the names, addresses and locations of UK gun owners. Guntrader is a site that is purely used to buy and sell legal firearms in the UK so 99% of those with an account have guns. The UK National Crime Agency are involved at a high level as this breach puts gun owners at high risk of criminal attack and theft of firearms by knowing who has them and where. Unlike some countries the UK has very strictly controlled firearms access and guns…

    1 vote
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    I did consider flagging it as sensitive, but there were insufficient reasons to exclude it from visibility. Further, Guntrader themselves don’t deem it necessary to hide the visibility of an email address on their service (see attachment).

  14. Clarify "<p>" within the "Title" Field of "Regler" Paste

    The relevant JSON returned from https://haveibeenpwned.com/api/v3/pasteaccount/test@example.com is quoted below:

    {
        "Date": null,
        "EmailCount": 627,
        "Id": "https://underground-revolution.eu/hacked/networkgaming_2013_04_16.sql",
        "Source": "AdHocUrl",
        "Title": "Regler.<p>"
    },
    

    Can you please clarify the inclusion of the "<p>" from "Title" field or if not needed please remove "<p>" from the "Title" field?

    1 vote
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  15. Add the recent 500K password breach for Fortinet VPNs

    With the recent revelation of the 500K+ passwords that were scraped from Fortinet VPNs all over the world, it would be of incredible value to be able to check if several deployments were caught up in the breach (by checking a few usernames). Thanks for the great work!

    3 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  16. Add a 'AddedDate' field for pastes

    With the current API, for the paste model it is mentioned that the paste date is only included if it is known, and that this value may be null.

    Can you please consider adding a 'date reported' field to the paste model, which would simply be the timestamp of when a given breach is reported by HIBP. That would give a usable reference point as to the possible age / currency of the paste, in the event that the regular date value isn't known.

    This would also be consistent with the breach model in the API, that differentiates between 'BreachDate'…

    1 vote
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  17. fix API v3 rate limiting which claims to be per API key

    The API v3 rate limiting documentation (https://haveibeenpwned.com/API/v3#RateLimiting) initially claims that the API is rate-limited on a per-API key basis. Reading the fine print, it indicates that the rate limit is actually applied to the IP address. This disconnect leads to immense challenges in working with the API at scale. For example, I bought 7 API key licenses today so that I could work through a very large data set more quickly. However, all of my API keys are working from the same source IP address. So every time your API gets busy, you start blocking me by my…

    3 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    The API is rate limited per key at the Azure API Management level. There are no rate limits per IP address. Usually when I hear a report like this, it’s because someone is inadvertently making too many requests so I’d normally suggest changing the API key (you can do that on the page you registered on), then testing the new key totally independently of your code, for example in Postman.

    Closing this “idea” as it’s not an idea, contact me directly if you still have problems: https://www.troyhunt.com/contact/

  18. Add credentials API (to check against strong hashes)

    HIBP unlike other services like enzoic does not yet provide a way to find matches if the breach data contains medium to strong protected passwords.

    To make that passwords searchable without cracking them the API needs to accept the username as input and returns a list of hashes together with meta information e.g. salt and hash algorithm. The client can then for all results use the provided hash algorithm for the password and compare it with the hash from the API result.

    security notes:
    1. you may want to add a second hash algorithm on top to avoid storing passwords…

    1 vote
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    The protection level of the password is not an area I want to get into as it leads to (often incorrect) assumptions about whether a breached password is suitable for use. There’s also no need to increase the strength of the hashing algorithm as it’s only designed to obfuscate the PII that appears in some records.

  19. Document IP addresses and stability for API

    Using your API from our environment requires that we update our network egress rules to allow us to reach you.

    I can easily see what IP addresses you're using now, but I can't tell how likely these are to change.

    Having this documented would help us make better decisions about how - or whether - to use your API.

    tia

    1 vote
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    1 comment  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
  20. improvements to domain search for bigger companies

    At thousands of employees, the usability of the domain search falls off a cliff. Here's some of the problems I'm seeing and what would improve my usecase significantly.

    problems:
    1) email and personal data leaks are a spam/phish/identity problem: password leaks are a direct attack liability
    2) company has been around for a decade, thousands of employees, list of leaks and affected users by any of the leaks is long and unwieldy
    3) constantly investigating users that are no longer active

    potential improvements:
    1) focus on password leaks as a higher level of leak than just email and/or personal data…

    3 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)
    You have left! (?) (thinking…)
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback

    Signed in as (Sign out)

    This really goes beyond the purpose of HIBP and starts to get into the internal triage processes of your organisation. The intention is to provide the data as I’ve been able to obtain it then the consumer works out what to do with it; which ones are serious (it differs by org), which addresses are still relevant (definitely not something I want to track), and what actions have been taken for an individual breach. APIs exist for you to handle this in conjunction with the domain search.

← Previous 1 3 4 5 9 10
  • Don't see your idea?

General

Categories

Feedback and Knowledge Base