3 ms·

When an email comes up as compromised in this dump, it would be great if that notification came with the filename(s) in that list where the email was found.

• zokier 9y ago
  Especially in this case I think including the filename would have been nice; manually going through list of 2.8k domains and trying to guess if you ever have happened to have an account there is no fun. Having the filename might also help verify the veracity of the information. I suppose the reason for omitting the filename is that Troy does not want to cast any unwarranted trust in the filenames, which is fair.
  • rocqua 9y ago
    My first guess was that by publishing the file-name, it is easier to link a compromised email to a password. I'd guess that, if you had access to the dumps, this functionality would be about a 10-20x speedup to lookups of the password belonging to an email. However, I think the real reason is privacy. If I recall correctly, there are certain breaches where HIBP redacts the website to protect privacy. A great example of this was ashleymadison. It kinda sucks when anyone that knows your email can learn you were on that site. It seems excessively hard to screen the entire list of 2800 items for such privacy concerns.