5 ms·

One thing that really keeps annoying me about HaveIBeenPwned is the fact that I can enter anyone's email and get their status immediately. This way I can anonym

by pvorb 6y ago

One thing that really keeps annoying me about HaveIBeenPwned is the fact that I can enter anyone's email and get their status immediately. This way I can anonymously check if that email had an account at a breached site at the time of the breach. The obvious solution would be sending out a link via email before results can be looked up, but this might not be in HaveIBeenPwned's interest.

sneak 6y ago
It’s not HIBP that caused that data leak. The fact of which emails have accounts on which sites is public following the breach/leak of that site’s data.
- pvorb 6y ago
  Yes, but you'd actually have to look for or even buy the leaks themselves in order to find out if somebody has been "pwned". I'm not arguing against the service in general, but there's an obvious way to improve privacy.
  - zamadatix 6y ago
    It seems a bit like the FBI warning at the beginning of DVDs, the only people that are going to be bothered by it are people that were going to play by the rules in the first place. The privacy was already lost, you can't increase it again retroactively. The ones marked sensitive have more a pattern of "we don't want to be caught in a court caste about hosting the info" than a pattern of trying to improve privacy in the ways this thread is suggesting.
  - techrat 6y ago
    The lookup doesn't tell you anything more than someone exists in a breech. You'd still have to have the data itself. If you have the data itself, then lookup is as simple as 'grep' or 'ctrl-f' So anyone who has the means to compromise someone they're looking up by having the data doesn't need the HaveIBeenPwned tool in the first place. Moot point, IMHO.
    - 55555 6y ago
      what if I use HIBP to check if any of my friends had registered accounts on a Furry Findom forum, which was recently breached? It's potentially embarrassing.
      - techrat 6y ago
        I'd argue reasonably smart people would use a different, non distributed/shared email address for sensitive things like fetish sites... ...and that your friends deserve a better friend than someone who would look up their email addresses to embarrass them.
      - MrGilbert 6y ago
        This breach would be marked as ”sensitive“, so you wouldn't be able to look that up without confirmation of ownership.
      - unholiness 6y ago
        You can't, because that specific breach has been marked as sensitive: https://haveibeenpwned.com/FAQs#SensitiveBreach https://haveibeenpwned.com/FAQs#SensitiveBreach
- Rebelgecko 6y ago
  Even though HIBP didn't cause the data leak, their aggregation makes it a lot easier to see which websites someone uses.
  - sneak 6y ago
    This is a good argument for my recommended practice of using a different domain/email for login accounts and personal correspondence. My public email address is not the one I use for logins anywhere.
rkagerer 6y ago
Some kind of "prove it's you" function would be great. When you register for notifications it sends out a verification email. That would be a good time to let you disable public lookup of your email address. I also wish HIBP could securely disclose the snippet of information from a leak that's relevant to you. Knowing the password or hash characteristics, phone number, etc. could aid in mitigation, and seeing the raw impact might help motivate ordinary users to improve their security hygiene. Suggested that idea to Troy in the past, and got the impression he's not amenable, largely due to the risks of hosting PII. Can't really blame him.
- unholiness 6y ago
  > That would be a good time to let you disable public lookup of your email address. https://haveibeenpwned.com/OptOut https://haveibeenpwned.com/OptOut
  - pvorb 6y ago
    Thanks, I didn't know there's a way to opt out.
  - rkagerer 6y ago
    That's helpful, thanks! For anyone else who's hesitant to use the link, these are the three choices presented when you opt out: https://i.imgur.com/4lB2bSq.png https://i.imgur.com/4lB2bSq.png If you pick the first one, you can still use the notification service (https://haveibeenpwned.com/NotifyMe https://haveibeenpwned.com/NotifyMe) to email yourself a private link to check what breaches include the address (past and current).
CGamesPlay 6y ago
This isn't universally true, the site does have a notion of "sensitive breaches" which will not be visible to someone who cannot confirm ownership of the email address. https://haveibeenpwned.com/FAQs#SensitiveBreach https://haveibeenpwned.com/FAQs#SensitiveBreach
- diarrhea 6y ago
  The list of examples reads like my browser bookmarks list.
- pvorb 6y ago
  I didn't know about this, thanks. So it's already implemented. I'd just prefer if every breach was marked as sensitive.
Abishek_Muthian 6y ago
But only due to HIBP integration in browser's password manager many come to know about their account leak even when the company which was breached didn't disclose it (as is the case in most countries). There's still a need gap to detect leaked file data online, Say after a ransomware attack our files end-up in pastebin[1]; currently there seems to be no way to know unless manually monitoring sites where leaked data is posted or for the attacker to themselves let you know. [1] Added in my profile.
IshKebab 6y ago
Yes then they could also show the actual data leaked. I'm supposedly in 11 breaches that include things like my date of birth and physical address. Maybe. But I don't really know. Did I give a fake DOB. Is it a previous address? Do they actually even have an address or is it just NULL for me? HIBP won't tell me.
tgsovlerkhgsel 6y ago
On the other hand, that means I don't have to do an annoying verification dance to look up my pwnages, and can help others look up their breach information without having to explain to them over the phone how to click a link in an e-mail.
globular-toast 6y ago
The point of hibp is this information is now public. Putting it behind some kind of identity check would be security by obscurity. The bad guys have the raw data and can look up any address at will.
- koheripbal 6y ago
  Public isn't "binary". Finding the leaked files, downloading them (often paying to do so), aggregating all the data from all of them and searching them all is a huge pain-in-the-butt. 99.99% of people would not go through this effort and lack the skill/knowledge, even if they were motivated against someone.
  - globular-toast 6y ago
    Maybe not, but the people you need to worry about would.
    - koheripbal 6y ago
      As a small business owner, there are a LOT of hateful people out there that would gladly do harm if they had more skills - thankfully they are also incompetent. But I appreciate your point.
tjpnz 6y ago
It's possible to opt out. But that does require knowing HIBP exists.

by pvorb 6y ago

sneak 6y ago

It’s not HIBP that caused that data leak. The fact of which emails have accounts on which sites is public following the breach/leak of that site’s data.

pvorb 6y ago
Yes, but you'd actually have to look for or even buy the leaks themselves in order to find out if somebody has been "pwned". I'm not arguing against the service in general, but there's an obvious way to improve privacy.
- zamadatix 6y ago
  It seems a bit like the FBI warning at the beginning of DVDs, the only people that are going to be bothered by it are people that were going to play by the rules in the first place. The privacy was already lost, you can't increase it again retroactively. The ones marked sensitive have more a pattern of "we don't want to be caught in a court caste about hosting the info" than a pattern of trying to improve privacy in the ways this thread is suggesting.
- techrat 6y ago
  The lookup doesn't tell you anything more than someone exists in a breech. You'd still have to have the data itself. If you have the data itself, then lookup is as simple as 'grep' or 'ctrl-f' So anyone who has the means to compromise someone they're looking up by having the data doesn't need the HaveIBeenPwned tool in the first place. Moot point, IMHO.
  - 55555 6y ago
    what if I use HIBP to check if any of my friends had registered accounts on a Furry Findom forum, which was recently breached? It's potentially embarrassing.
    - techrat 6y ago
      I'd argue reasonably smart people would use a different, non distributed/shared email address for sensitive things like fetish sites... ...and that your friends deserve a better friend than someone who would look up their email addresses to embarrass them.
    - MrGilbert 6y ago
      This breach would be marked as ”sensitive“, so you wouldn't be able to look that up without confirmation of ownership.
    - unholiness 6y ago
      You can't, because that specific breach has been marked as sensitive: https://haveibeenpwned.com/FAQs#SensitiveBreach https://haveibeenpwned.com/FAQs#SensitiveBreach
Rebelgecko 6y ago
Even though HIBP didn't cause the data leak, their aggregation makes it a lot easier to see which websites someone uses.
- sneak 6y ago
  This is a good argument for my recommended practice of using a different domain/email for login accounts and personal correspondence. My public email address is not the one I use for logins anywhere.

rkagerer 6y ago

Some kind of "prove it's you" function would be great. When you register for notifications it sends out a verification email. That would be a good time to let you disable public lookup of your email address. I also wish HIBP could securely disclose the snippet of information from a leak that's relevant to you. Knowing the password or hash characteristics, phone number, etc. could aid in mitigation, and seeing the raw impact might help motivate ordinary users to improve their security hygiene. Suggested that idea to Troy in the past, and got the impression he's not amenable, largely due to the risks of hosting PII. Can't really blame him.

unholiness 6y ago
> That would be a good time to let you disable public lookup of your email address. https://haveibeenpwned.com/OptOut https://haveibeenpwned.com/OptOut
- pvorb 6y ago
  Thanks, I didn't know there's a way to opt out.
- rkagerer 6y ago
  That's helpful, thanks! For anyone else who's hesitant to use the link, these are the three choices presented when you opt out: https://i.imgur.com/4lB2bSq.png https://i.imgur.com/4lB2bSq.png If you pick the first one, you can still use the notification service (https://haveibeenpwned.com/NotifyMe https://haveibeenpwned.com/NotifyMe) to email yourself a private link to check what breaches include the address (past and current).

CGamesPlay 6y ago

This isn't universally true, the site does have a notion of "sensitive breaches" which will not be visible to someone who cannot confirm ownership of the email address. https://haveibeenpwned.com/FAQs#SensitiveBreach https://haveibeenpwned.com/FAQs#SensitiveBreach

diarrhea 6y ago
The list of examples reads like my browser bookmarks list.
pvorb 6y ago
I didn't know about this, thanks. So it's already implemented. I'd just prefer if every breach was marked as sensitive.

Abishek_Muthian 6y ago

But only due to HIBP integration in browser's password manager many come to know about their account leak even when the company which was breached didn't disclose it (as is the case in most countries). There's still a need gap to detect leaked file data online, Say after a ransomware attack our files end-up in pastebin[1]; currently there seems to be no way to know unless manually monitoring sites where leaked data is posted or for the attacker to themselves let you know. [1] Added in my profile.

IshKebab 6y ago

Yes then they could also show the actual data leaked. I'm supposedly in 11 breaches that include things like my date of birth and physical address. Maybe. But I don't really know. Did I give a fake DOB. Is it a previous address? Do they actually even have an address or is it just NULL for me? HIBP won't tell me.

tgsovlerkhgsel 6y ago

On the other hand, that means I don't have to do an annoying verification dance to look up my pwnages, and can help others look up their breach information without having to explain to them over the phone how to click a link in an e-mail.

globular-toast 6y ago

The point of hibp is this information is now public. Putting it behind some kind of identity check would be security by obscurity. The bad guys have the raw data and can look up any address at will.

koheripbal 6y ago
Public isn't "binary". Finding the leaked files, downloading them (often paying to do so), aggregating all the data from all of them and searching them all is a huge pain-in-the-butt. 99.99% of people would not go through this effort and lack the skill/knowledge, even if they were motivated against someone.
- globular-toast 6y ago
  Maybe not, but the people you need to worry about would.
  - koheripbal 6y ago
    As a small business owner, there are a LOT of hateful people out there that would gladly do harm if they had more skills - thankfully they are also incompetent. But I appreciate your point.

tjpnz 6y ago

It's possible to opt out. But that does require knowing HIBP exists.