General
213 results found
-
Question: Does HIBP check user ids as well as email address?
Some websites use userids instead of email addresses. Are userids checked the same as email addresses?
1 voteNo.
-
HOSTINGER.COM HAD A DATA BREACH
I’m not lying, I got an email from them. Here is the blog post about it:
https://www.hostinger.com/blog/security-incident-what-you-need-to-know/3 votesThis UserVoice is for feature suggestions. Please contact me here if you have data to load: https://www.troyhunt.com/contact/
-
Normalize all searches to lower case
I sometimes capitalize portions of my email address.
After checking the same email address twice - one time all lower case and another using some upper case - I got different results!1 voteAll email address searches are not case sensitive. If you’ve found an exception, please contact me privately with the address in question: https://www.troyhunt.com/contact/
-
api call
Hi i want to ask about API,
i try to call the API via $.ajax and send the hibp-api-key by header, i checked the hibp-api-key at RequestHeader and its correct
and i get this message in the console
readyState":0,"status":0,"statusText":"NetworkError: Failed to execute 'send' on 'XMLHttpRequest': Failed to loadcan you help me?
1 voteThis User Voice is for feature suggestions. If you’re trouble shooting your implementation, I suggest you try Stack Overflow.
-
Version Pwned Password API
Can you version the "Pwned Passwords" API v2 to reduce the confusion with https://haveibeenpwned.com/API/v3#APIVersion please?
Can the "Pwned Passwords" API endpoint also specify which release of https://haveibeenpwned.com/Passwords is used within its URL?
3 votesAt this stage there’s no plan to version the Pwned Passwords API an it’ll continue to run independently to the APIs for searching breaches.
See the “last-modified” response header on the API if you’re looking to identify when the data is current as of.
-
Domain Search Email Validation Not Working
I'm not receiving emails while attempting to validate my ownership of a domain. We're using Office 365 and the email doesn't appear to be getting caught by the spam or phishing filters.
3 votesThis site is used for feature requests, not support. If you’re not receiving emails it’ll be because your mail server is blocking them.
-
Can I have my account show up normally- like no breaches found, since I opted out accidentally
Can I have my account show up normally- like no breaches found, since I opted out accidentally ?
I am not sure where to post this but I want it like that
1 voteAt this stage there is no option to un-opt-out. Furthermore, depending on how you opted-out your data may have been permanently deleted from the online system anyway.
-
Stop using google analytics for logging what's entered in the forms (when searching for a password or an email) - that's a privacy violation
Just stop using it!
1 voteGoogle Analytics does not log data entered into forms on HIBP.
-
Fix your SMTP server records in DNS (reverse lookup not working).
Fix your SMTP server: the SMTP server you are using to verify domains does not have a reverse lookup address, so emails are either rejected or marked as spam by any server that is well configured.
4 votesI’m closing this out following a discussion with the last commenter. This was due to the recipient mail server bouncing emails. For anyone else that stumbles across this, if you reject email from HIBP then you can’t get email from HIBP! The outbound address is noreply@haveibeenpwned.com
-
Any suggestions as to anything that can be done to fix any problems associated with these list.
Would like to see some suggestions as to how to repair/improv being victims of the instances you unveil.
1 voteAlready implemented.
-
consider social security numbers?
What potential is there to provide data on SSN that have been exposed in a breach? This seems much more borderline dangerous, but curious about of you've given any thought and the problems / possibilities you see.
1 voteAmerican social security numbers are considered sensitive personally identifiable information and I don’t intend to store them in HIBP.
-
Fix multi-domain search results
Apparently, multi-domain search result for breached email account sets are broken. Maybe only for large result sets?
I did a multi-domain search after the avectis breach notification with over 10.000 of our company and customer emails affected. However, the "Breached email accounts" tab in the excel format was empty. The HTML did not load (result set to big) and the JSON also only included "{"BreachSearchResults":null, ..."
Can you check this please?17 votesMulti-domain searches were dropped a while back, searches now need to be done on a per domain basis. But we're just about to launch an API if you'd like to automate it, vote here if you'd like to be notified when it's ready: https://haveibeenpwned.uservoice.com/forums/275398-general/suggestions/19170856-add-domain-search-capability-to-the-api-functions
-
Insert Breach's "Permalink"
Can you please insert the breach's "Permalink" returned by the API?
For example, include "Permalink" : "https://haveibeenpwned.com/PwnedWebsites#Adobe" similar to the existing key/value pair of "LogoPath".
3 votesYou can already derive this from the breach name: https://haveibeenpwned.com/PwnedWebsites#{breach name}
-
small 'best of' download files instead of full 10 gb...
in one of the recent blogs from you or cloudflare, it is talked that basically it would be best to deny all passwords with a count > 100 and warn on password > 20. would it be possible to create download files just for these (i think) like 10 mil records (all > 20)? that would make it easier to create a local repository database with a workable download size and working count. ... and ignoring the rare passwords which make up the largest bucket of your collection.
1 voteYou can easily do this yourself by pulling down the entire data set then just extracting all records within the threshold you’ve chosen. I don’t want to publish multiple versions of the same data at different thresholds, this is a very subjective decision and it can easily be extracted from the existing data,
-
Allow User Submissions
Please allow users to submit pwnd passwords.
I just had Google notify me that someone tried to log in with my password from Java Indonesia, yet this password is not in the pwnd password list.
1 voteThere’s a whole world of problems with allowing individual self-submitted strings in this fashion. HIBP will remain focused on the larger incidents with bigger volumes of data.
-
More Info Needed
A community board for questions.
I'd like to know how my email was caught up in a breach on a website I never went to.1 voteThis is not a feature suggestion.
Refer to this blog post for answers to your question: https://www.troyhunt.com/why-am-i-in-a-data-breach-for-a-site-i-never-signed-up-for/
-
I dont understand what to do
Everyone is very excited about this site. But honestly I am confused. I've received a message about my primary email address many times. But there's absolutely no action I can take based on that. Yes, good password hygene, yes, dont reuse passwords. But that's generic advice that I get without needing to be notified. What is the increment of information I get by receiving your email? I think that there is none. Can you help me understand your value?
1 voteUserVoice is used for ideas and feature requests. Assuming this is related to Collection #1, please see the discussion on this blog post and ask a question in the comments there if it isn’t already addressed in the post: https://www.troyhunt.com/the-773-million-record-collection-1-data-reach/
-
Add searching by username
If leaks contain usernames and passwords, wouldn't it be important to be able to find out if one of your usernames has been compromised? Or do emails always accompany the passwords?
1 voteAssuming you mean usernames that are user-chosen strings as opposed to email addresses, this functionality existed in HIBP for a while but was later deprecated. Usernames in this form are not uniquely identifiable, often don’t exist at all (email addresses are used instead) and most importantly, can’t easily be parsed out of a large dump with a regex like email addresses can be. So in summary, low value and high effort.
-
don't log data that has been input via the website
a few days after I tested several of my passwords, I started receiving emails from different websites, that someone was trying to log into my accounts. and these are accounts that I haven't used for several years...
your pawny website is a a phishing scam and people should never ever use it!!!
3 votesPer the FAQs and privacy policy, no data is logged and the behaviour you’re experiencing has not originated from HIBP.
-
Update your pwned list. My email has been pwned, but you do not know.
I get email threats saying the email and password is compromised. They even list the password. But this email is not showing up in your list.
3 votesI can only add data I have access to. If you have a breach not already in HIBP, I can add that.
- Don't see your idea?