General
189 results found
-
Make the bitcoin-related sites sensitive
Otherwise, users of bitcoin could be targeted in order to steal their bitcoins (as they are worth so much right now).
3 votesThe criteria I use for sensitive breaches is that the public discoverability potentially causes harm; adult websites, for example, have a social stigma.
An increased likelihood of phishing is common to all breaches and at present, I don’t feel that a site merely being financial in nature is sufficient to categorise it along with the likes of Ashley Madison.
-
Distribute large files via torrents...
subject says it all...
3 votesThis blog post explains why I didn’t use torrents: https://www.troyhunt.com/introducing-306-million-freely-downloadable-pwned-passwords/
Plus, with Cloudflare caching the file at their edge nodes, I can’t see any tangible upside to a torrent.
-
md5 password check
be able to lookup if your password exists in a breach by entering an md5 of your password rather than the actual password.
3 votesThere’s no upside to MD5. SHA-1 is used not with the expectation of people having SHA-1 hashes in the first place, but rather having the plain text in the first place then using SHA-1 as part of the k-anonymity implementation: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/
-
Humio Pawned
Received this mail:
Dear Humio user,On Monday, November 4th, we became aware that an authenticated user of cloud.humio.com could use an API call to retrieve a full list of cloud.humio.com users, including names and email addresses. No other information was exposed.
You are receiving this email because your name and email could have been exposed.
We only know of a single incident where someone unintentionally accessed this information. They immediately reported this to us (thank you!). However, we can’t definitively identify whether any other users accessed and stored this data. If you retrieved any user names or email addresses,…
3 votesPlease keep User Voice for suggested features. If you have access to a data breach you’d like to submit, get in contact with me here: https://www.troyhunt.com/contact/
-
fix API v3 rate limiting which claims to be per API key
The API v3 rate limiting documentation (https://haveibeenpwned.com/API/v3#RateLimiting) initially claims that the API is rate-limited on a per-API key basis. Reading the fine print, it indicates that the rate limit is actually applied to the IP address. This disconnect leads to immense challenges in working with the API at scale. For example, I bought 7 API key licenses today so that I could work through a very large data set more quickly. However, all of my API keys are working from the same source IP address. So every time your API gets busy, you start blocking me by my…
3 votesThe API is rate limited per key at the Azure API Management level. There are no rate limits per IP address. Usually when I hear a report like this, it’s because someone is inadvertently making too many requests so I’d normally suggest changing the API key (you can do that on the page you registered on), then testing the new key totally independently of your code, for example in Postman.
Closing this “idea” as it’s not an idea, contact me directly if you still have problems: https://www.troyhunt.com/contact/
-
complete alpha list of pwned breached sites?
alpha list of pwned breached sites & contact info.
CONSUMERS need to know if the sites they use are in a list of breached sites and how to contact the developer, webmaster to stay on them to fix it. My password keepers show some sites as breached but not on your page of listed sites (which I presume have been fixed?) How do you handle the breached sites which haven't been hardened?
2 votesHIBP only lists breaches that have been loaded into the service, it's not an index of every known incident.
-
Give us if our email is likely to be pasted.
We should be told if a hacker can still access our email or paste it. We should be told that once we receive our results,
2 votesThere is no way of knowing this.
-
Add wpengine.com breach
There was a breach on wpengine.com, maybe data about accounts will be available somewhere
https://wpengine.com/support/infosec/1 voteI’m not aware of this breach being in the public domain but if you happen to have it, contact me privately. Closing this out to keep the UserVoice for feature ideas.
-
either allow use of email from domain registration, or don't claim to
The domain registration page says "Verifying by email is the fastest way to confirm ownership of the domain. You can either verify using an email address on the domain registration record or by using one of several pre-defined addresses for the domain." However, in fact I cannot find any way to use the email address actually on my domain registration record (paleo.org), as it is not one of the four standard addresses listed.
1 voteSupport query rather than an idea (and resolved now anyway).
-
1 vote
Relates to a specific scenario within the Ashley Madison data breach.
-
To use hashed email address as part of the query instead of HTML encoded
I don't know if this is already available, but I feel it will be a better idea.
1 voteIt provides next to no security (I already have billions of addresses I could use to crack it) and it would require an entire copy of the system hence doubling up on all the storage costs.
-
Not very smart features
I've changed my password but my mail remain in the list. When my account will be "pwned" again, I will not know about it.
1 voteHIBP is a reflection of which emails were breached in which systems and is not designed to track what changes are made to an account post-breach.
-
Charge for the service
Good service but I think you need $ to improve it.
A user could be charged a small amount, around €1, for the release of information related to a security breach.
The basic account could be free but the user would have to pay for advanced services.1 voteI’m quite clear at this time that I don’t want to charge people for a service that does them good, nor do I want to put them at more risk by making data beyond their email address accessible over the web.
-
Please reconsider including leaked password in Notification Emails. Consider letting users opt in.
Your users should treat this password as public information, as should you. If you are concerned about storing this information, then delete the leaked passwords once the notification emails have been sent.
The beneficial impact of all users knowing exactly which of their passwords have been leaked is likely much greater than the dangers of your copy of the passwords being leaked since these passwords are already in the open and should be treated as public information.
If you still feel against this, then please at least make it an opt in option. Let people opt in to agreeing to…
1 voteIt’s just too risky to handle this sort of data in a publicly facing service and not be able to store it as a secure cryptographic hash. Opting in would made a large amount of additional work to service a very small portion of the overall accounts in a breach.
-
Somehow add suspected breaches
Since I use a seperate email address for every domain I register for (forum/webshops) I have a fairly good picture of breached sites (currently many forum sites). Is there a way to add/investigate/report these?
1 voteThere’s not much I can do without hard data, there are a lot of reasons why an email address unique to one site may start receiving spam and a breach is just one of them.
-
1 vote
There’s information on the FAQs page about how privacy is handled.
-
Why did I receive an email indicating pwned on the JustDate fabricated breach, but when I search from the Home page, not listed?
Why did I receive an email indicating pwned on the JustDate fabricated breach, but when I search from the Home page, only the Linkedin breach is noted? Is it possible that the email was spoofed? It looks almost exactly like the one i received when you posted the Linkedin breach. I suspect many others are in this same situation. Esp. if the Justdate breach was indeed 24 million people as the email indicated. Thanks.
1 voteIt’s fully explained in the link in the email: https://www.troyhunt.com/introducing-fabricated-data-breaches-to-have-i-been-pwned/
-
What is LogoType?
Can you describe what the intended use of the LogoType field in the Breach object is? I can't find anything in the API docs that describes the field. I know what SVG and JPG are, but to what do they refer? Do you have (or plan to have) an API that will return a logo for the name of a breach? I can see from the source of your web pages that you have that data in the content folder
1 voteThis is intentionally undocumented and will be replaced by a formally documented alternative in the future.
-
Mark ArmorGames as confirmed pwned
I use unique email address per subscriber, and I suddenly started receiving spam on the email I used to signup for armorgames.
They are not trustworthy. -- this is not an idea, but saw that you have listed them as unconfirmed, I can confirmed my data was leaked from their site --
1 voteIt’s the combination or Armor Games and Coupon Mom together which means this breach is unverified; I can’t emphatically say which addresses are from which service.
-
I'm getting an "Oh no catastrophic failure" message repeatedly for one password in particular - I'd like to understand what that means.
I'd like to understand what the "Oh no catastrophic failure" message actually means.
1 voteInsufficient information to reproduce
- Don't see your idea?