> There is no good reason why every random Joe should be able to type in my mum's, daughter's or son's email address in HIBP and see whether one of them has bee

> There is no good reason why every random Joe should be able to type in my mum's, daughter's or son's email address in HIBP and see whether one of them has been signed up on a Cannabis website, gambles online, or trades with bitcoin or is signed up with an organisation that tries to help people with a certain condition. Not only that, but seeing what pastes their email can be found in is an issue. Just last week was a post on the front page of HN where someone did exactly that: found what paste a friend's email was in, downloaded the paste, and using a few extra steps recovered the hashed password [0]. While it's possible to find all the leaked information and search it manually, aggregating in a single place adds convenience for those with legitimate uses but also for nefarious purposes. [0]: https://news.ycombinator.com/item?id=14919845 https://news.ycombinator.com/item?id=14919845