3 ms·
It’s a very easy fix, confirm ownership of the email address before exposing the results.
by samwillis 7y ago
It’s a very easy fix, confirm ownership of the email address before exposing the results.
- _underfl0w_ 7y ago...if the password for said email address is already visible on the same page (assuming negligent password reuse) what kind of verification could you hope for?
- AshleyGrant 7y agoHave you actually used HIBP?
- jfdhu 7y agoOnly if in possession of the email address or domain name. Where an email address or domain name has been taken over by someone else, then sending the results to the email address instead of currently showing it on the webpage doesnt solve the problem. This data set is ripe for blackmailers, intelligence services and any company looking for intelligence on rival businesses.