5 ms·

I really don't think HIBP should even be publishing or notifying people about these. It's almost always existing breaches just merged together in a different wa

by r1ch 8y ago

I really don't think HIBP should even be publishing or notifying people about these. It's almost always existing breaches just merged together in a different way. If I went and grabbed the raw torrents and combined them in various ways I could make hundreds of different "credential stuffing" lists. Would HIBP list and notify people about all of them?

laken 8y ago
This post doesn’t mention it, but on past credential stuffing lists that got loaded, Troy mentioned how many were new to the HIBP dataset. I’d assume that there were enough new emails on here to make it worth loading.
- ikeboy 8y ago
  Post does mention it.
- r1ch 8y ago
  94% of the email addresses were already in the database according to the Twitter account. 6% still represents many millions in this case, but perhaps it's unnecessary to notify the ones already known.