General
204 results found
-
Investigate this: Dear Alumni & Friends, Report of a Data Security Incident I am writing to notify you of a data security incident that ha
Dear Alumni & Friends,
Report of a Data Security Incident
I am writing to notify you of a data security incident that has affected one of the University’s third party service providers, Blackbaud, which provides cloud computing software used for processing some of your personal data.
We recognise that this is unsettling news and we sincerely apologise that this has happened, but rest assured that Blackbaud have taken steps to mitigate this incident and any risks to your information. The University is following up with internal investigations and remedial actions of its own. However, we advise that you be vigilant…
1 voteThis is not a feature suggestion, it’s a breach disclosure notice related to the Blackbaud incident.
-
Check Pastir.com for pastes
Mine was there but your site didnt find it
1 voteThat site doesn’t look like a paste site.
-
1 vote
HIBP is not intended to be a personal triage tool, rather a historical reflection of data breachs
-
Option to return "no breaches found" in json body, rather than simply a 404 status
It would be good to be able to return something in the json body when no breaches are found for an account.
A parameter to enable this message would be great.
I'm working with a 3rd party software to pull data, and doesn't expose the status in an accessible way.(I would have thought a 204 status would have made more sense?)
1 voteHTTP 404 is the semantically correct response code, there’s no reason to include anything further in the body. Sounds like a deficiency with the product you’re using if it’s unable to interpret response codes correctly.
-
improvement on awarness and great feature
It would be better if u also added the info about which site leaked our data, no need to give passwords...
It would encourage us to let our friends know about it if they used the same website and create a lot more interest and awareness all around.
I know this data(which site leaked it) might be hard to get and might be rarely available .You might know only few of thosee.But still ,a start in this direction might be lovely and show to other people that u dont know where the leak came from...they might help u provide the…1 voteHIBP already tells you which site leaked the data, it appears immediately after performing a search.
-
Fix QuinStreet information
QuinStreet is not an online service, it has leaked my info it must have accuired from buying it from other companies that I do not know who is. They have no login that can be fixed. Firefox Monitor uses your service to alert for this company, but as is it makes little sense to present it as a web service I have signed up for.
1 voteI can’t see anything in the submitted idea to suggest the description is incorrect.
-
Help victims of cyber stalkers
I have a friend who is being absolutely terrorized by a computer savvy guy who is backhandedly threatening her life, posting her real name on adult websites, hacking her voicemails, opening accounts with her information and we believe he has now shared her info on some dark web place allowing other hackers access to her information. We have made police reports and even contacted the FBI cyber crimes unit. But this guy is using VPN’s and change your number apps. He calls and harasses her constantly, for over 4 months now this has been going on. I heard about this…
1 voteThis is not a feature suggestion for HIBP.
-
1 vote
This is not feasible for the reasons mentioned here: https://www.troyhunt.com/the-ethics-of-running-a-data-breach-search-service/
-
Send me the data, not just the site name
When you find my email in a breached site and on a list somewhere where you say that my email and password were found, send me the details (i.e. the password or hashed password) so I can decide whether I need to change my password. I use a different password at every site. So knowing more than just my email was found a list would be useful.
1 voteHere are all the reasons I don’t make passwords available via Have I been pwned: https://www.troyhunt.com/here-are-all-the-reasons-i-dont-make-passwords-available-via-have-i-been-pwned/
-
Describe why a search of an e-mail address using the form and API return different results
If I search for my work e-mail address on the web page, I get no results. However, if I search for my work e-mail address with the API I get two results.
Why is this different?
I am suspecting that the lack of passwords in the breach constitutes not being pwned?1 voteSounds like you’re not using the IsVerified param correctly on the API.
-
I suggest adding a date stamp so we can see when info that's pulled up in a search was last updated.
1 voteBreach data remains largely unchanged after load. Create and modified dates are available via the API if you want more granular data: https://haveibeenpwned.com/API/v3#AllBreaches
-
Email reminders for varification
After the second or third reminder the last one does not contain the email address any more in the text. My improvement: Add the mail address as in the other reminders for a better UX.
1 voteThis is intentional to change the format slightly in the hope of not being flagged as spam.
-
Add incremental updates to the PWNd password data sets
While it wouldn't preserve order, generally, it would greatly reduce the burden on people downloading those data sets for their own use. It has the potential to drastically reduce the bandwidth costs for the system as users would likely download the bulk of the set just once and then get the updates thereafter.
1 voteThis isn’t feasible as each incremental update doesn’t just add new passwords, it updates the counts on existing ones too. Better just to use the k-anonymity API.
-
Fix Email verification
FIx your email verification process. Years back people reporting that emails are not received, IT people watching their email logs confirming nothing is received from your site. Today I am in same boat yesterday and today been trying check email logs at smart host/filter and O365 and neither has any sign of your verification email. There is an issue unfixed you need to resolve.
1 voteEmail delivery checks out just fine: https://www.mail-tester.com/test-difjlr0tj
Talk to your provider if you’re finding it blocked,.
-
Notify me of specific site breaches?
I'd imagine I'm not the first to ask about this but can't see it listed. If I have an account with a site, say the BBC site, can I sign up to be informed of confirmed data breaches even if my particular email address is not in a set of compromised data? Apologies if this already addressed - point me to it.
1 voteThis would effectively amount to a per-individual corpus of sites to be monitored which really isn’t something I want to maintain in HIBP. If you have an account with the service and you’re subscribed to notifications, you’ll be notified anyway if it appears in a breach.
-
Password List Version Diff
Any way to publish just an NTLM and SHA-1 differential file on the next release of the password list? This would greatly help when importing the list into SQL so as not to require a full re-import of any newly published password lists.
1 voteA huge portion of the entries change on each load due to the counts being revised. if downloading the corpus is burdensome, better to use the k-anonymity API.
-
Allow incremental hashes for those of us who are not permitted to use the API
Different organizations have different security postures. Your list of hashes may be transferred into secure systems in text format where they are processed in order to match against internal password databases.
Unfortunately, despite the k-anonymity interface, exfiltrating even a partial password hash is forbidden. Given this use case, I believe it would be advantageous to provide incremental hash lists for every addition made to the database between major releases of the complete list. Daily, or even weekly would be good.
The objective would be to notify users immediately if the hash of their current password is ever added to the…
1 voteDeltas are infeasible because it’s not just new hashes being added, it’s the counts on existing ones changing too. Best bet is to either load the complete hash set or use the public API. I understand different security postures with regards to using the API, but this is why it implements k-anonymity which there shouldn’t be a practical barrier against using, at least not from a privacy perspective.
-
Premium subscription
A premium API subscription that would allow domain search and show actual passwords would be awesome. This is already available online from multiple vendors but costs that are just too high.
1 voteThis would circumvent domain ownership verification and the presence of passwords would post enormous risks to individuals in breaches. That’s just not a situation I’m comfortable with.
-
Search for non decrypted passwords
As we can download both SHA-1 and NTLM password list, I suppose this list concerns only decrypted passwords that have been re encrypted with SHA-1 and NTLM.
So what about non decrypted passwords ?
I can see a lot of breaches where (fortunally) only the digest has been pwned and the digest algorithm is known.
Are there databases of encrypted passwords with their digest algorithm waiting to be decrypted ?
If yes it could be a nice feature to test passwords against all these databases using the corresponding algorithm...
1 voteThere are multiple problems with this:
Firstly, passwords are almost never encrypted, they’re hashed. If they are encrypted then without the private key you really can’t verify the password by any means.
Secondly, when hashed, they’re almost always salted as well so just knowing the algorithm used isn’t sufficient for a password hash provided by a user to be verified, I’d have to provide the salt used as well. That would mean storing that in a way that could be retrieved for that user which amounts to needing credential pairs which is too risky for my comfort.
Thirdly, it’s a very niche audience that could use this, namely people technical enough to hash their own password (with the salt, if needed) and then pass it back to the service.
In short, it’s high effort, high risk and low value given the niche nature of it.
-
Add FalixNodes.net
There was recently a security breach on FalixNodes, this includes all passwords to the Game Panel, which were all eventfully reset by the owner of FalixNodes.
1 voteThis is not a feature suggestion.
- Don't see your idea?