Skip to content

Claudio Brandt

← Customer feedback for Have I Been Pwned

My feedback

1 result found

  1. Enable search and notifications for email addresses using the "+" syntax

    2,646 votes
    Vote

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close
    You have left! (?) (thinking…)
    117 comments  ·  General  ·  Admin →
    How important is this to you?

    We're glad you're here

    Please sign in to leave feedback
    Signed in as (Sign out)
    Close
    Close
    Claudio Brandt supported this idea  · 
    An error occurred while saving the comment
    Claudio Brandt commented  · 

    (I understand there were similar suggestions, to which the response was to look at https://haveibeenpwned.uservoice.com/forums/275398-general/suggestions/6774229-enable-search-and-notifications-for-email-addresse, which concerns email aliases with '+'. But while aliases are necessarily known to the user who created them, variations with dot can be arbitrarily created by hackers and will be accepted both for email AND login by Gmail)

    So the problem is:

    Gmail is an ubiquitous email provider.
    Gmail accepts dots anywhere in the username.
    Gmail ignores dots, so that:

    user123 is the same as:

    user.123
    user.1.2.3
    u.ser123
    etc

    A hacker intent on evading HaveIBeenPwnd monitoring could easily add dots to all Gmail addresses before selling and/or leaking a list of email and passwords. This way, after a major leak is advertised, user123@gmail visiting HIBP may leave with a false sense of security that their password wasn't in the leak because currently HIBP will only return a match for the exact address(es) input by the user.

    But if the hacker added a dot somewhere in the address, the combination username+password would still be available to access the account, while the legit user would not have a clue that their password was compromised.

    The solution: for each Gmail address, remove the dots before adding to HIBP's database, so that:

    1) user123, user.123, u.ser123 etc will be stored as user123 within HIBP's database;
    2) when an user visits HIBP and inputs their Gmail address, any variation caused by dots will be stripped of dots before matching against HIBP's database, resulting in a positive even if a dot variant username was leaked.

    Thanks,
    CB

Feedback and Knowledge Base

(thinking…)