General
110 results found
-
Enable search and notifications for email addresses using the "+" syntax
A lot of people use a syntax such as troyhunt+foo@hotmail.com where foo is a unique identifier for the site. They do this so that if they begin getting spammed, they can identify the source their email came from.
At the moment, HIBP treats this is a totally unique email address so if I've search for the parent email address without the "+" syntax, it won't be found. This idea is to ensure that searches and notifications recognise the syntax and return addresses that are logically still the same account.
One thing HIBP would also need to do is specify which…
2,568 votes -
Allow root domain to verify subdomains
This idea can be broken down into two seperate ideas, I'd be happy with either.
When registering to monitor a domain that is a subdomain of another, for example subdomain.domain.com, the verifcation email should be able to be sent to postmaster@domain.com.
Allow an option to monitor a domain and all subdomains.
136 votes -
Add SSH leaked keys
We believe the future of credentials checking goes beyond just password, and integrating SSH key checking would add lots of value to www.haveibeenwned.com.
SSH keys are also sensitive credentials that are increasingly exploited by attackers in our research findings. We are willing to share our up-to-date SSH leaked key database with www.haveibeenwned.com.97 votes -
Allow a family member to accept sending notification to someone else.
For example, my parents wouldn't know what to d with this, but I'd like to add them with the option to report to me when they are compromised so I can fix it for them. Ideally, I'd add their emails and they would receive a notice to accept or deny, if they accept I get alerts on them in the future. Can optionally leave sensitive items out of report. I could also see this as helpful for consultants but maybe you could sell that. I'd actually pay for it for my parents too.
95 votes -
add a timeline of breaches
It would be great to see a timeline of breaches, and a graph of the total accounts compromised (maybe separately showing the date of breach and when it was discovered/reported). I know that this year has seen a few big breaches disclosed, thanks Yahoo & MySpace, although they date back somewhat.
83 votes -
allow the pwnd password query to show the sites/breaches the password was included in?
I have a relatively unusual password that I used to use widely. However, I stopped doing that years ago. It currently shows up in 6 breaches. I would love to know which sites still have it so that I can check/resurrect those accounts.
70 votes -
Indicate if the same credentials have appeared in another breach
Nice, now I know that my mail-address was included in the Exploit.In and Adobe breach. But the Exploit.In breach does not hint any clue whether we talk about the same service (=Adobe) or not. I can understand that you cannot mail me a password. After all you don't know me. I might as well be an imposter. But it would be cool if you could internally setup your database such that it outputs whether the password in an amalgamated-list-breach that did not specify a service like Exploit.In was identical to the one in another breach like the Adobe breach. That…
60 votes -
Sort pwned sites by date
HI Can you sort pwned sites by date rather than alphanumeric - most recent discoveries first?
60 votes -
Badges!
Would be amusing to have an hibp breach count badge next to peoples usernames on blogs/etc. alongside their twitter badge, SO scores, etc.. Might help to raise awareness of hibp.
59 votes -
supply date of pwning in search results
When showing results of searches of pwned accounts, you should show the date of the file or hack so users can be informed whether they have changed their passwords since that date.
38 votes -
Add wildcard support for spamgourmet addresses
Spamgourmet.com allows a user to create disposable email addresses on the fly. That way a unique email address can be used for each web site you sign up for. The structure of an address is identifier[.##].username@spamgourmet.com, where the identifier can change per site and [.##] is an optional max number of emails you want to receive. Because a different address is used for each site it is currently impossible to query HIBP for breaches of all sub-addresses, like *.username@spamgourmet.com. Allowing wildcard search and notification for spamgourmet addresses (or its many alias domains) would enable users to…
34 votes -
Sort breaches by date
This is mostly useful for those of us who like to check for new leaks involving our email addresses every few months. Currently one has to read through the whole list of results since they're in a seemingly arbitrary order, including those one has already changed the relevant passwords for.
34 votes -
Closed EMail Accounts
Would it be possible to Register for HIBP EMail Notification via another designated EMail Address provided, to which the HIBP Notification could be "forwarded" ? ie.: Confirmed and Secure Registration under a designated EMail Address, for one or more 'Closed' EMail Addresses ?
33 votes -
Domain name opt-out support
The opt-out form is only available for email addresses.
Please add support for full domain opt-out.32 votes -
Provide visibility of email addresses subscribed for domains
Provide visibility and manageability of email addresses subscribed for domains to ensure only appropriate people are receiving notifications.
26 votes -
The ability to report data breaches
In many cases of small businesses, customers know about problems through internal emails much faster than large media. So there should be the possibility to report data breaches with sources. Perhaps with a form and in addition you can forward internal e-mails directly.
22 votes -
21 votes
-
Make a section on what to do if you have been pawned.
So, Iv'e been pawned? What's next? What do I need to do? How can I fix this issue or protect myself from this happening again? You talk about being pawned but I don't see anything in simple English on the next steps besides using your password generator which I have been using for years but still got pawned.
21 votes -
add icons for passwords and credit card numbers in report
Since breaches of passwords and credit card numbers are so much worse than any other breaches, it would be great if you added icons to the Pwned sites column in the report. That is it would say:
Adobe, Forbes🔑, Vodaphone💳, Zomato🔑
This allows people to focus on the most important issues first. Dates would help in this regard:
Adobe 2013, Forbes🔑2014, Vodafone💳2013, Zomato🔑2017
This isn't adding any information you don't already have, just making it more convenient.
(The emoji are 🔑 U+1F511 or🗝️ U+1F5DD and 💳 U+1F4B3.)
Thanks for providing this great service!
20 votes -
Provide localised language versions
IMO, HIBP is so useful that every single person in the world should have it bookmarked and all companies should monitor their domains accounts using it. Some users in our company use their business email address to create accounts in several websites, and thanks to HIBP our IT team is warned when one of them is pwned.
We thought it would be a great idea to tell everyone about HIBP so they could verify and monitor their own personal accounts, so we did it by sending an email telling about HIBP to everyone in the company. Everyone was able to…17 votes
- Don't see your idea?