General
220 results found
-
Bring back sorted hashes
I used to lookup password hashes by a binary search in the sorted password list (iterating over the initial database and the 2 updates).
With the new database 2.0 this is no longer possible (unless I sort the downloaded hashes).
Please bring back the sorted hashes.
I do not care for the counts that have been added - perhaps another file with sorted hashes and without counts (to somewhat reduce the file size) could be offered for download?
1 voteI’m trying to avoid having multiple versions of the same thing, I suggest that if a different order is important you just do a one-off reordering of the file.
-
What is LogoType?
Can you describe what the intended use of the LogoType field in the Breach object is? I can't find anything in the API docs that describes the field. I know what SVG and JPG are, but to what do they refer? Do you have (or plan to have) an API that will return a logo for the name of a breach? I can see from the source of your web pages that you have that data in the content folder
1 voteThis is intentionally undocumented and will be replaced by a formally documented alternative in the future.
-
1 vote
There was no Twitter breach, they inadvertently logged passwords to an internal system and there’s no evidence they were ever obtained by an unauthorised party.
-
I'm getting an "Oh no catastrophic failure" message repeatedly for one password in particular - I'd like to understand what that means.
I'd like to understand what the "Oh no catastrophic failure" message actually means.
1 voteInsufficient information to reproduce
-
Mark ArmorGames as confirmed pwned
I use unique email address per subscriber, and I suddenly started receiving spam on the email I used to signup for armorgames.
They are not trustworthy. -- this is not an idea, but saw that you have listed them as unconfirmed, I can confirmed my data was leaked from their site --
1 voteIt’s the combination or Armor Games and Coupon Mom together which means this breach is unverified; I can’t emphatically say which addresses are from which service.
-
when I enter capital letter in domain name it is not working. Please make it case sensitive
when I enter capital letter in domain name it is not working. Please make it case sensitive
1 voteDomain searches definitely aren’t case sensitive, add specific details if you believe it’s not working with a particular name.
-
Domain Verification - Not received after several tries.
Verification token sent An email containing a verification token has been sent off to the address you chose, just copy................
Kindly help for fix.
For your note:
1. Domain not blocked in mail server
2. haveibeenpwned domain - whitelisted
3. message header not found in mail server inbound logs1 voteUser voice is for submitting new ideas so I’m closing this one out. Make sure your mail server is allowing messages from noreply@haveibeenpwned.com
-
Question: any way to opt-out a closed e-mail account address?
I asked to opt-out an e-mail address, but since I closed the e-mail account (it's already a year since) I find difficulty in confirming the verification e-mail. Any alternative thing I can do to try to block the e-mail address from showing in this site? Thanks!
1 vote -
Provide database dump for hashes of email address for offline download
This can be very useful for companies to verify if their users (non-staff) are affected by any breaches and inform them to not share password for different systems. I'm residing in EU, GDPR doesn't allow us to send email to your API to check if a particular email address appear in any breach.
1 voteThis would enable anyone to download everyone’s data. Hashes may be cracked which would allow for mass enumeration of emails in a breach. There is no provision in GDPR which prohibits an EU data subject from searching for their email address via the online service.
-
Any suggestions as to anything that can be done to fix any problems associated with these list.
Would like to see some suggestions as to how to repair/improv being victims of the instances you unveil.
1 voteAlready implemented.
-
small 'best of' download files instead of full 10 gb...
in one of the recent blogs from you or cloudflare, it is talked that basically it would be best to deny all passwords with a count > 100 and warn on password > 20. would it be possible to create download files just for these (i think) like 10 mil records (all > 20)? that would make it easier to create a local repository database with a workable download size and working count. ... and ignoring the rare passwords which make up the largest bucket of your collection.
1 voteYou can easily do this yourself by pulling down the entire data set then just extracting all records within the threshold you’ve chosen. I don’t want to publish multiple versions of the same data at different thresholds, this is a very subjective decision and it can easily be extracted from the existing data,
-
located source of a paste
I was informed that my email was on a paste AE4dYZG1.txt 6 Jan 2019 involving 3091 accounts.
The source of this breach is www.netpricedirect.co.uk.1 voteThank you. Closing here as it’s not a feature request.
-
I dont understand what to do
Everyone is very excited about this site. But honestly I am confused. I've received a message about my primary email address many times. But there's absolutely no action I can take based on that. Yes, good password hygene, yes, dont reuse passwords. But that's generic advice that I get without needing to be notified. What is the increment of information I get by receiving your email? I think that there is none. Can you help me understand your value?
1 voteUserVoice is used for ideas and feature requests. Assuming this is related to Collection #1, please see the discussion on this blog post and ask a question in the comments there if it isn’t already addressed in the post: https://www.troyhunt.com/the-773-million-record-collection-1-data-reach/
-
send part of password hash per mail
since we have the recommendation of 'never entering a password on a website, unless it's the password field of the according website', i'd suggest to build an send by mail request form.
if you enter your email, you can choose to get those first 5 chars of all pwned password hashes to the entered email.
with this, you ensure, that only the pwned email addresses get their pwnge data... (which ofc won't help if the mail account itself has already been hijacked)this would help greatly, to check wich password may be leaked and need a change.
1 voteFor now, I remain adamant that storing even a part of a password against an email address presents an unacceptable risk for all. More: https://www.troyhunt.com/here-are-all-the-reasons-i-dont-make-passwords-available-via-have-i-been-pwned/
-
I want to use my own Password-Creation
Hello!
I lerned only two years English 1965 til 1967
(Ich lernte nur zwei Jahre englisch von 1965 bis 1967).Please translate 'pwned' in German - I cannot find in Google a german Word foŕ it (Bitte übersetzen Sie 'pwned' in deutsch - Bei Google finde ich keine Übersetzung für 'pwned').
Normally I use 'Startpage' instead of 'Google' (Normalerweise benutze ich 'Startpage' statt Google).
Thank You - Yours faithfully
Gerd Taddicken - GermanyTSA15Jan19, 18.34 h (UTC minus 1 hour?)
+++
1 voteMultilingual support is definitely not on the cards, it’s a very high overhead for both initial implementation and ongoing support.
-
I want to use my own Password-Creation 2
I want to use my own Password-Creation (II) without your service 'Free for 30 days'.
Thank you
Gerd TaddickenDeutsch: Ich möchte mein eigenes Passwort kreieren, generieren ohne ihr System ,30 Tage frei für das Passwort-System'.
TSA25Jan19, 18.38 h - Local time Germany)
+++
1 voteThis is not a feature suggestion.
-
Add searching by username
If leaks contain usernames and passwords, wouldn't it be important to be able to find out if one of your usernames has been compromised? Or do emails always accompany the passwords?
1 voteAssuming you mean usernames that are user-chosen strings as opposed to email addresses, this functionality existed in HIBP for a while but was later deprecated. Usernames in this form are not uniquely identifiable, often don’t exist at all (email addresses are used instead) and most importantly, can’t easily be parsed out of a large dump with a regex like email addresses can be. So in summary, low value and high effort.
-
More Info Needed
A community board for questions.
I'd like to know how my email was caught up in a breach on a website I never went to.1 voteThis is not a feature suggestion.
Refer to this blog post for answers to your question: https://www.troyhunt.com/why-am-i-in-a-data-breach-for-a-site-i-never-signed-up-for/
-
Allow User Submissions
Please allow users to submit pwnd passwords.
I just had Google notify me that someone tried to log in with my password from Java Indonesia, yet this password is not in the pwnd password list.
1 voteThere’s a whole world of problems with allowing individual self-submitted strings in this fashion. HIBP will remain focused on the larger incidents with bigger volumes of data.
-
Stop using google analytics for logging what's entered in the forms (when searching for a password or an email) - that's a privacy violation
Just stop using it!
1 voteGoogle Analytics does not log data entered into forms on HIBP.
- Don't see your idea?