General
194 results found
-
Fix your verification links
Your service is unusable because you are sending out verification links by email with tokens in them that are invalid.
1 votePlease use User Voice for suggesting new ideas.
Separately, I’m seeing verifications performed just fine at present, contact me directly with details if it’s not working for you personally: https://www.troyhunt.com/contact/
-
Wildcard support
Similar to the requests for 'wildcard support for spamgourmet' and 'searches using the "+" syntax' Fastmail (and I suspect other providers) offer the facility to send email to <anything>@<myemail>.fastmail.com - where the "normal" email address is myemail@fastmail.com
I use this extensively to register unique email addresses for each site (so if spam comes in i can see where it was leaked from) but in many cases i've no record of which sites i've used addresses on.
as such it would be very useful to check for *@<myemail>.<providerdomain.com>
to prevent abuse e.g. someone trying to register *@hotmail.com then send a verification…
1 voteThe big difference with the plus aliasing syntax is that it’s a very broadly adopted pattern that whilst not a spec (and frankly, that’s a big part of why this feature doesn’t exist), is broadly supported. I don’t want to get into a cycle where one specific mail provider (and a smaller one at that) implements something specific to them and HIBP needs to implement that pattern.
-
An ability to remove the alarm
Seen the breach, I have changed all my passwords some of them several times over. This name and password list are several years out of date. So old as to be useless. The alarms are now false.
1 voteHIBP is intended to be a record of breaches, not a personal triage service that enables individuals to track whether they’ve responded to a breach.
-
Add Unacademy data breach of 11M users in database
An education app Unacademy is reported to have data breached of 11M-22M Users. Kindly add that to database.
3 votesPlease use User Voice for feature suggestions. If you have data from a breach and you’d like it loaded, get in touch with me here: https://www.troyhunt.com/contact/
-
I sorted the 100K password text file alphabetically. There appear to be duplicates.
Remove duplicates from 100K password file
1 voteHIBP does not have a “100k password list”.
-
Feature that allows you to search for all the sites your email has been used to create a log in for
I would like to know which websites I have created a username on with my email address so that I can access them and manage the passwords for them. at this time, I can only manage the ones I REMEMBER using my email to sign up with, but I know there are probably hundreds out there that I have created login credentials for because just about every site or out there requires you to create an account in order to use it.
I want to protect those accounts BEFORE I know a breach has occurred so there are no surprises.
3 votesThis is what a password manager does! Here you go: https://haveibeenpwned.com/1Password
-
question here... are non-user data not exposed?
what I want to ask is that... when those mailicious people gain access to a database, do they just go for emails and passwords? I am sure there are other data such as creation dates, private messages, ssn, interests and more, are these exposed as well? do the mailicious people strip out these info before posting online?
why your site and other similar sites not have data classes for these other info?
1 voteUserVoice is intended for feature suggestions, not general discussion.
-
GDPR complience
In order to be GDPR compliant when using the service, we need assurance that the e-mail address we provide is not to be stored or passed over to a third party (and some other requirements). Can you sign a document that states that, so we have someting to show during audits?
3 votesThis is already addressed in the FAQ here: https://haveibeenpwned.com/FAQs#Logging
-
Fix the opt-out.
I was able to opt out public searches on 1 of 2 accounts. The second one I went through the steps and it now tells me I have opted out, however I am still able to look up the second email.
1 voteUserVoice is for suggesting new idea, not submitting bugs so I’m “declining” this one.
Feel free to get in touch personally and give me the email address you’re having problems with: https://www.troyhunt.com/contact/
-
1 vote
Without information as to what benefit that would provide, I’m closing this off as “declined”.
-
Site pwned notefull.com
https://pastebin.com/JhbQGea2
a bunch of passwords3 votesAdded to HIBP as a paste, closing this as “declined” as User Voice is typically meant to be for new ideas
-
Provide the count of breached accounts on a domain
As part of the API, provide the count of breached accounts on a domain in a time window. I realise that for the domain search, users need to prove ownership of the domain before receiving the list of breached emails, which certainly makes sense. If the count of breached accounts on a domain isn't deemed too sensitive to disclose, this would be useful in third party risk monitoring applications which could then display "50 accounts with emails on your domain @domain.com have been breached in the previous 3 years" for example.
12 votesI’m declining this one simply for the reason you’ve already highlighted: it’s too sensitive. For example, you could restrict the range to the time of the Ashley Madison data breach, feed in the domain of a small company and start to draw some pretty sensitive conclusions. As it stands, domain owners can already derive this info so there’s way more risk than upside to this one.
-
Help - your search showed a password was in a breach. I got an email from a scammer quoting that password. How do I find out what sites it
Give specifics to help us delete the problem
1 voteThis User Voice is only for feature suggestions.
-
search by hash to be EU GDPA laws compliant
As a security company I would like to be able to search in your database on behalf of my clients for their employees emailadresses. The current laws in EU prohibit this unless HIBP signs a DPA - contract with my company OR we do not provide you with the emaildadress but just a hash. My company would even pay money for this.
I know you already declined this a couple of times but so far nobody mentioned the aspect of law compliancy.
THX for your work3 votesThis has already been raised and declined here: https://haveibeenpwned.uservoice.com/forums/275398-general/suggestions/8234421-allow-users-to-search-for-an-email-address-by-hash
-
Use certificates that specify OCSP Must-Staple
The Qualys SSL Server Test shows that haveibeenpwned.com uses certificates that do not specify OCSP Must-Staple. When you replace these certificates near their expiry date, please get certificates that specify OCSP Must-Staple. Scott Helme has a good article on why OCSP Must-Staple is important.
https://www.ssllabs.com/ssltest/analyze.html?d=haveibeenpwned.com
https://scotthelme.co.uk/ocsp-must-staple/1 voteTLS termination is done at Cloudflare and this is not a configurable attribute. It poses a minor risk hence the A+ SSL Labs rating HIBP receives.
-
Drop support for weak cipher suites
The Qualys SSL Server Test shows that haveibeenpwned.com supports weak cipher suites for TLS 1.2. Please drop support for these to make haveibeenpwned.com even more secure.
https://www.ssllabs.com/ssltest/analyze.html?d=haveibeenpwned.com1 voteTLS termination is done at Cloudflare and this is not a configurable attribute. It poses a minor risk hence the A+ SSL Labs rating HIBP receives.
-
Domain search
I own several domains and I would like to check any email adress with that domain.
Simply verify by sending confirmation request on a random email address with that domain e.g. h1ytsh4t uhh674@larshjorth.dk3 votesThis read like a personal request for verification with a non-standard alias. HIBP already provides a mechanism for domain verification using standard administrator email addresses.
-
A search for xyz@gmail.com and xyz@googlemail.com should return the same
Since user@gmail.com is the same address as user@googlemail.com the returned data should also be the same, currently you'd have to enter both addresses.
Some users might not even know about this.0 votesThis is akin to what’s already been proposed in this suggestion: https://haveibeenpwned.uservoice.com/admin/v3/suggestions/6774229/
Namely that there are multiple versions of an address that all go to the same mailbox. It’d be great if you could leave that comment over on that idea and I’ll close this one out.
-
Humio Pawned
Received this mail:
Dear Humio user,On Monday, November 4th, we became aware that an authenticated user of cloud.humio.com could use an API call to retrieve a full list of cloud.humio.com users, including names and email addresses. No other information was exposed.
You are receiving this email because your name and email could have been exposed.
We only know of a single incident where someone unintentionally accessed this information. They immediately reported this to us (thank you!). However, we can’t definitively identify whether any other users accessed and stored this data. If you retrieved any user names or email addresses,…
3 votesPlease keep User Voice for suggested features. If you have access to a data breach you’d like to submit, get in contact with me here: https://www.troyhunt.com/contact/
-
Don't use Gravitar
On a website that helps people mitigate the impact of losing private data you prevent use of avatars without signing up to an arbitrary third party with whom users may have no previous relationship and certainly no reason to trust. This feels strangely at odds with the core ethos of your website.
11 votesLooks like this is an issue with UserVoice, not HIBP.
- Don't see your idea?