General
230 results found
-
Distribute large files via torrents...
subject says it all...
3 votesThis blog post explains why I didn’t use torrents: https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/
Plus, with Cloudflare caching the file at their edge nodes, I can’t see any tangible upside to a torrent.
-
don't log data that has been input via the website
a few days after I tested several of my passwords, I started receiving emails from different websites, that someone was trying to log into my accounts. and these are accounts that I haven't used for several years...
your pawny website is a a phishing scam and people should never ever use it!!!
3 votesPer the FAQs and privacy policy, no data is logged and the behaviour you’re experiencing has not originated from HIBP.
-
3 votes
This is already supported here: -https://haveibeenpwned.com/OptOut
-
Makes no sense why you wont give information concerning pending lawsuits or how to get things started
What other outcome could there possibly be then litigation against those who do not take proper steps to ensure our data is protected . We can't like go to the company an say "please don't let anybody else know my sensitive data", litigation is our only recourse an you know this so why are you against suing these maggots,obviously your on their side if your against litigation,no other way to force change
3 votesThere's a long-form response here: https://www.troyhunt.com/data-breaches-class-actions-and-ambulance-chasing/
What other outcome could there be? Regulatory penalties, and they already happen. Making lawyers rich by mounting frivolous lawsuits that provide no more than a few bucks to plaintiffs, whilst causing organisations to behave defensively rather than transparently, is not a healthy situation. I'm not "on their side" or I wouldn't be running this service.
As to why use this service, it's because it gives you visibility into data breaches you may not otherwise know about. If that's not of relevance to you, then don't use the service.
-
Humio Pawned
Received this mail:
Dear Humio user,On Monday, November 4th, we became aware that an authenticated user of cloud.humio.com could use an API call to retrieve a full list of cloud.humio.com users, including names and email addresses. No other information was exposed.
You are receiving this email because your name and email could have been exposed.
We only know of a single incident where someone unintentionally accessed this information. They immediately reported this to us (thank you!). However, we can’t definitively identify whether any other users accessed and stored this data. If you retrieved any user names or email addresses,…
3 votesPlease keep User Voice for suggested features. If you have access to a data breach you’d like to submit, get in contact with me here: https://www.troyhunt.com/contact/
-
Notification before loading breach onto Azure
In the past I have recreated the Maltego Graph of all breached sites/names and domains and when I have pushed this to GitHub another breach has been loaded on the same day by a tweet from https://twitter.com/haveibeenpwned
Can you publish a counter estimating when the next series of breaches will be made available?
I understand that breaches may be loaded concurrently and/or urgently, etc. Neither am I asking for you to publish the name of the website that you are confirming has been breached, etc
3 votesThere’s nowhere near enough predictability to do this, just monitor the breaches API and you’ll know as soon as a new one is there.
-
Insert Breach's "Permalink"
Can you please insert the breach's "Permalink" returned by the API?
For example, include "Permalink" : "https://haveibeenpwned.com/PwnedWebsites#Adobe" similar to the existing key/value pair of "LogoPath".
3 votesYou can already derive this from the breach name: https://haveibeenpwned.com/PwnedWebsites#{breach name}
-
Domain search
I own several domains and I would like to check any email adress with that domain.
Simply verify by sending confirmation request on a random email address with that domain e.g. h1ytsh4t uhh674@larshjorth.dk3 votesThis read like a personal request for verification with a non-standard alias. HIBP already provides a mechanism for domain verification using standard administrator email addresses.
-
Include leaked password
You very kindly just sent me an email that my email address and unsalted password were included in the 2012 LinkedIn breach.
I can't remember which password I was using in 2012, and hence don't know which other accounts need a password change. Could you send the leaked hash (or otherwise, depending on the breach) to the effected email?
3 votesThis presents too many risks, more info here: https://www.troyhunt.com/here-are-all-the-reasons-i-dont-make-passwords-available-via-have-i-been-pwned/
-
You have been blocked from accessing this resource on Have I Been Pwned
Today is the first time we have ever visited hibp. Clicking on the test http link we immediately received the blocked message shown in the title.
3 votesUserVoice is for suggestions for the site that are shared publicly. Try using the contact page on troyhunt.com if you’re having a specific problem.
-
search by hash to be EU GDPA laws compliant
As a security company I would like to be able to search in your database on behalf of my clients for their employees emailadresses. The current laws in EU prohibit this unless HIBP signs a DPA - contract with my company OR we do not provide you with the emaildadress but just a hash. My company would even pay money for this.
I know you already declined this a couple of times but so far nobody mentioned the aspect of law compliancy.
THX for your work3 votesThis has already been raised and declined here: https://haveibeenpwned.uservoice.com/forums/275398-general/suggestions/8234421-allow-users-to-search-for-an-email-address-by-hash
-
Catch all
Implement support for catch all email addresses. I use a different mail address per website I register to. Its all on the same domain that is configured to support catch all e-mail. In theory I could use an UUID email adres per website.
In order to proof you are the owner you could send a verification mail to a random mailadres for the given domain.
3 votesThis feature already exists, it’s under the “Domain search” link in the nav.
-
Provide Delta files between versions of the Password DB for offline mirror updates
for offline mirrors it is important to be able to stay up to date - dropping the index and whole db only to reimport all 550M entries is a long time - for local offline copies the # of breaches may not be important but the new hashes are - can you provide delta files of the newly added SHA1s only for easier updates?
Love using the service btw!
would also keep your bandwith lower for people only needing the new stuff by downloading smaller files
3 votesDeltas would still be extremely large due to the prevalence counts on so many of the passwords changing. Best bet is to either download the new version or if that becomes inconvenient, hit the k-anonymity API.
-
HOSTINGER.COM HAD A DATA BREACH
I’m not lying, I got an email from them. Here is the blog post about it:
https://www.hostinger.com/blog/security-incident-what-you-need-to-know/3 votesThis UserVoice is for feature suggestions. Please contact me here if you have data to load: https://www.troyhunt.com/contact/
-
Add possibility to get total count of leaked emails for specific domain through API
Possibility of getting count of total emails addresses leaked for specific IP is very useful due to problems of exporting the data for domain search when there real many emails. In my case happened that after export if showed only "Pastes" database and no other leaks. I have checked some email addresses from exported CSV list and through online database, results were not the same.
And if total count for domain will be available, it will be much easier to compare results and see the differences, also such information can be useful for online threat intelligence platforms.3 votesA count alone won’t do much good, people want to know who was impacted in the breach. Plus, you already get a count at the top of the search page or can look at the rows in the CSV.
Separately to this, if the results you’re seeing aren’t accurate, just check it’s not due to public searches not showing sensitive breaches.
-
Add a captcha
Because people often use the same user and password combination on multiple sites. If you can search here if you have an account on multiple sites, others can too. If you can slow down automatic search, abusers can be scared away
3 votesA CAPTCHA implementation poses an unacceptable usability barrier whilst providing little practical benefit and would entirely break the API implementation.
-
Provide a open sourced version of the PB scraper for users to run at home and tinker with.
Title explains it.
3 votesHIBP gets the paste feed from Dumpmon which is already open-sourced here: https://github.com/jordan-wright/dumpmon
-
Site pwned notefull.com
https://pastebin.com/JhbQGea2
a bunch of passwords3 votesAdded to HIBP as a paste, closing this as “declined” as User Voice is typically meant to be for new ideas
-
Domain Search Email Validation Not Working
I'm not receiving emails while attempting to validate my ownership of a domain. We're using Office 365 and the email doesn't appear to be getting caught by the spam or phishing filters.
3 votesThis site is used for feature requests, not support. If you’re not receiving emails it’ll be because your mail server is blocking them.
-
consider social security numbers?
What potential is there to provide data on SSN that have been exposed in a breach? This seems much more borderline dangerous, but curious about of you've given any thought and the problems / possibilities you see.
3 votesAmerican social security numbers are considered sensitive personally identifiable information and I don’t intend to store them in HIBP.
- Don't see your idea?