Anonymous statistics about the collected data
Just to satisfy our hunger for data and curiosity about lists of all kinds of things, it would be interesting if the massive amount of data HIBP was processed to produce new data. It doesn't need to be searchable like Shodan's or GreyNoise's (while this would be amazing we don't need to think too much to understand the implied risks) and should not disclose sensitive information, but even with this limitation in the way it would be presented to the public (and keeping in mind the growing adoption of GDPR and similar regulations around the world), there are several processing that could be applied to extract new insights of this data, like the number of times a unique account is pwned as it ages through the years since HIBP is collecting data, for example, when an email account appears for the first time it is year one, and then several statistics could be generated using this, such as X % of the emails are pwned 1, 2, 3, 4, n times since HIBP started collecting data, X % of the emails addresses were pwned again in an average Y months or years after it's first pwn, also cross-links between where and how the accounts and related information where revealed could bring more insights about how our data is well or badly handled or protected by others (companies mostly) and so how easily it could be obtained.
Most of us already know the problems that can come with a leaked account and password (or personal data alone when it's sensitive and allows the user identification), how worst it is if the same one is used in other places/sites, and we also know how to minimize the risk to nearly zero by simply using unique passwords and subscribing to HIBP, and given the number of online accounts we accumulate along the time and to be less paranoid with where and how we store our passwords, a growing number of us are adopting one or more password managers. But I think that this kind of data could be useful to raise awareness about the 'password' problem (and all inherent security problems that IT brings along with its wonders) and why using unique and strong passwords is so important. And why using password managers matters.
I think the way I explained and the examples above are not as clear as I intended, so feel free to use the comments to ask questions or to tell me how to make it more clear.
-
Eduardo R. commented
I'm sorry, I started typing and only noticed the size of the "letter" I wrote when I submitted it.... I may try to shorten it when I have more time.