4 ms·
To be fair, I was saying this from the very beginning, but Troy should have never even started to disclose user emails and in which data breaches they have been
by dustinmoris 9y ago
To be fair, I was saying this from the very beginning, but Troy should have never even started to disclose user emails and in which data breaches they have been affected publicly via HIBP.
There is no good reason why every random Joe should be able to type in my mum's, daughter's or son's email address in HIBP and see whether one of them has been signed up on a Cannabis website, gambles online, or trades with bitcoin or is signed up with an organisation that tries to help people with a certain condition. Troy decides based on his own personal world view which web sites are unethical to disclose publicly (e.g. porn sites or Ashley Madison) and which not, which is often very problematic in my view. Even though Troy tries to act as ethical as possible, in the end his world view is only the one of an old(er) white male Aussie who loves old petrol fuelled sports cars, which is quite antique itself. Clearly there's issues then when services such as Cannabis.com, crackcommunity.com, Foxy Bingo or Acne.org are publicly disclosed by him, but Ashley Maddison not.
HIBP is a good service, but there should be two major changes made:
- Don't let anonymous people type in email addresses and disclose information to them. Just don't show people any information about an email which is not theirs. Period.
- Allow people to remove themselves from HIBP. Not everyone is comfortable to think that some dude in Australia is collecting a huge database of all data breaches in which they have been affected, ultimately building a user profile about someone's interests, sexual preferences, political views and more without their consent.
- SmallDeadGuy 9y ago> There is no good reason why every random Joe should be able to type in my mum's, daughter's or son's email address in HIBP and see whether one of them has been signed up on a Cannabis website, gambles online, or trades with bitcoin or is signed up with an organisation that tries to help people with a certain condition. Not only that, but seeing what pastes their email can be found in is an issue. Just last week was a post on the front page of HN where someone did exactly that: found what paste a friend's email was in, downloaded the paste, and using a few extra steps recovered the hashed password [0]. While it's possible to find all the leaked information and search it manually, aggregating in a single place adds convenience for those with legitimate uses but also for nefarious purposes. [0]: https://news.ycombinator.com/item?id=14919845 https://news.ycombinator.com/item?id=14919845
- nkrisc 9y agoI think a better solution would be that when an email is entered, nothing is shown on the site but instead an email is sent to the entered address with the breaches it appears in. Maybe I'm crazy, but didn't HIBP used to work like that years ago?
- HIBC2017 9y agoExactly the reason for why I decided to launch: https://www.haveibeencompromised.com https://www.haveibeencompromised.com. I don't think Troy recognises the potential dangers with running a lookup service that criminals can utilise (they do).