6 ms·

All this seems to be hinting more than ever, that the time to provide these results directly and exclusively to the email address being queried is approaching.

• jtbayly 7y ago
  You’ve convinced me. I didn’t know anybody could lookup my info. I only want it for myself. Only thing is, there are a couple of old email addresses I used to use that I don’t have access to anymore. I guess I just need to shrug at that at this point.
  • eli 7y ago
    The bad guys have access to it either way. That's the whole point: this is data that already leaked.
    • jtbayly 7y ago
      As discussed elsewhere in this thread, there are real benefits provided to bad guys by allowing them to look up this information about anybody in a central location.
      • eli 7y ago
        This just feels like another iteration of the Full Disclosure debate.
        • jtbayly 7y ago
          Interesting. Good point. I'll have to think about that.
        • zaroth 7y ago
          I’ve never heard Full Disclosure concepts applied to serving stolen PII in an API. The reason is that the purpose of full disclosure is to shame the vendor into ensuring the patch is made, and to warn the user base that the attack is possible, while disclosing a flaw in a commercial product. In this case, we are not effectively doing either naming or shaming by publishing actual email addresses, rather than just user counts and the type of hashing that was performed. And at the same time the information being “bartered” is private user information and not merely identifying a flaw in a commercial product. I fail to see how an API into the HIBP database can be justified under the concept of full-disclosure. Particularly when the service could have been implemented as an email report to the queried email address.
          • jtbayly 7y ago
            You left out the biggest part of full disclosure in my opinion. The reason for full disclosure is because those who are affected by a security flaw in a product they are using have a right to know about the dangers of that piece of software. But once I put that down in writing I discovered you are right about the difference in this instance. The person who has the right to know about the flaw in this instance is the list of people whose accounts were compromised. Giving it to the general public is to further victimize them, rather than help them protect themselves.
            • Ao7bei3s 7y ago
              I don't think that's the most important part. Rather: Full disclosure can also protect previously unaffected / potential future customers, by warning them of companies that have been so lax with their security that they've been breached. So to achieve a comparable upside to full disclosure, HIBP needs to also make aggregate data publicly available. Which they do: https://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites
      • ReverseCold 7y ago
        There are plenty of other similar services that you can find that cheaply do the same thing AND provide you with the leaked hashes/emails. HIBP doing the same thing with less friction for people who are trying to learn about security is probably fine in comparison.
• diminoten 7y ago
  Sorry, but the cat is out of the bag. HIBP is evening the playing field, making the data less valuable to those who have the skills to collect it. It's the same thing as responsible/full disclosure; by making this information available to anyone (publish a vulnerability), you greatly reduce the power of those who have the skills to collect it anyway (the person who found the 0day). So yes, this information needs to be available, or it'll only be some people who have it, not none, and those few people who do have it will be 10x stronger than they are now. This is the old Antisec debate all over again, let's skip to the part where we end up agreeing generally that disclosure is better, okay? No need to relive 2009 or whatever.
  • nwah1 7y ago
    "Disclosure" could mean many things. The idea of providing the info directly via email to the affected user seems to adequately disclose things to the relevant parties. Are there additional benefits of the public api that on balance benefit the public more than attackers?
    • diminoten 7y ago
      Yeah, the availability of the data being common rather than rare, so the skill of collecting that data doesn't create a power structure where only the hackers/skilled users have power. Imagine it being $500/month to access HIBP, because that's the alternative, not some, "everyone agrees to only use this info for good".
      • jtbayly 7y ago
        Explain to me how anybody besides myself can use info about my leaked account for something good or useful. I can’t think of an example. Therefore, having that info cost more is better. Having it cost a lot more is a lot better. (I’m assuming I can still get access for free by having provided directly to my email address.)
        • bfdm 7y ago
• massaman_yams 7y ago
  Bulk emailing notifications to all affected addresses would be a deliverability nightmare, and would require manual intervention at most ISPs to prevent these messages from being blocked, which said ISPs may or may not be willing to do. Just think of the number of clueless users who would mark such a notification as spam, and the number of old, dead addresses, some of which are now spamtraps. edit: clarify bulk vs. individual notifications
  • dmix 7y ago
    That's a service Have I Been Pwned has been offering for years...?
    • massaman_yams 7y ago
      For single addresses that specifically request it, which is both fine and hugely different from bulk notifications to any/all addresses observed in a breach, which is what I was referring to. But I realize the wording in the original post is a little ambiguous; I had read "provide ... directly" as implying "push", but that may not be the case, and if so my comment above is not relevant.