3 ms·

> Has this email been compromised in a data breach? Eep. My email is listed half a dozen times in Have I Been Pwned records, but I use different passwords for

> Has this email been compromised in a data breach? Eep. My email is listed half a dozen times in Have I Been Pwned records, but I use different passwords for every site, so this means nothing.

detaro 5y ago
In the context of this thing, it means it's an email address that has been used elsewhere?
- jffry 5y ago
  That's what I would hypothesize as well. Inclusion in a leak by HIBP increases the confidence that it's a real address (but not the converse). Weighting is left as an exercise for the library consumer :)
  - bee_rider 5y ago
    It is a weird metric -- sure, inclusion in HIBP increases the chance that it is a real email, but it also drastically increases the chance that the person who's using the email address isn't the original owner. Signed, the twitch account that "I" created.
    - jffry 5y ago
      That would only be a problem if you didn't ultimately require email verification. At least to me, this seems like a tool to decide if you should send email verification or block the signup attempt, but I can see how some people might choose to use the information from this tool to allow verification-free account signup
      - bee_rider 5y ago
        It seems like lots of places will let you start using the service without actually waiting for a response to the verification email. If they would use "in HIBP" as a flag to indicate that they have to actually wait for the user to click the verification link, that would be pretty cool.
luma 5y ago
This is just a tool that can run several checks, HIBP is one of the things the tool can check. At this point, probably everyone that has used a given email address for a significant length of time is going to be somewhere on HIBP. An app developer who uses this tool to prevent registration from an email that hits on this single test is going to discover the folly of their decision pretty quickly. Don’t blame the tool.
- sokoloff 5y ago
  I assumed the intention behind using HIBP was to permit registration of an email address in the database without further checking.
kstrauser 5y ago
Here, let me simplify that code: def has_user_been_pwned(email): return True There. It's nearly impossible to be on the Internet at all without having some account or another be involved in an exploit at some point. You could rename the endpoint `user_had_a_facebook_or_twitter_or_linked_account_or_has_a_credit_score()`. This is a worthless thing to query because it tells you absolutely nothing about the owner of the address.
- Extigy 5y ago
  I think it’s genius, but evil. Like you say, real email addresses have all been pwned so this is a way to test for bogus or typo’d email addresses. What a way to ruin a wonderful thing! Abusing the haveibeenpawned service in this way has worried me enough that I’ve now gone and removed my data from the publicly searchable database. I’ll use the notification service instead.

> Has this email been compromised in a data breach? Eep. My email is listed half a dozen times in Have I Been Pwned records, but I use different passwords for every site, so this means nothing.

detaro 5y ago

In the context of this thing, it means it's an email address that has been used elsewhere?

jffry 5y ago
That's what I would hypothesize as well. Inclusion in a leak by HIBP increases the confidence that it's a real address (but not the converse). Weighting is left as an exercise for the library consumer :)
- bee_rider 5y ago
  It is a weird metric -- sure, inclusion in HIBP increases the chance that it is a real email, but it also drastically increases the chance that the person who's using the email address isn't the original owner. Signed, the twitch account that "I" created.
  - jffry 5y ago
    That would only be a problem if you didn't ultimately require email verification. At least to me, this seems like a tool to decide if you should send email verification or block the signup attempt, but I can see how some people might choose to use the information from this tool to allow verification-free account signup
    - bee_rider 5y ago
      It seems like lots of places will let you start using the service without actually waiting for a response to the verification email. If they would use "in HIBP" as a flag to indicate that they have to actually wait for the user to click the verification link, that would be pretty cool.

luma 5y ago

This is just a tool that can run several checks, HIBP is one of the things the tool can check. At this point, probably everyone that has used a given email address for a significant length of time is going to be somewhere on HIBP. An app developer who uses this tool to prevent registration from an email that hits on this single test is going to discover the folly of their decision pretty quickly. Don’t blame the tool.

sokoloff 5y ago
I assumed the intention behind using HIBP was to permit registration of an email address in the database without further checking.

kstrauser 5y ago

Here, let me simplify that code: def has_user_been_pwned(email): return True There. It's nearly impossible to be on the Internet at all without having some account or another be involved in an exploit at some point. You could rename the endpoint `user_had_a_facebook_or_twitter_or_linked_account_or_has_a_credit_score()`. This is a worthless thing to query because it tells you absolutely nothing about the owner of the address.

Extigy 5y ago
I think it’s genius, but evil. Like you say, real email addresses have all been pwned so this is a way to test for bogus or typo’d email addresses. What a way to ruin a wonderful thing! Abusing the haveibeenpawned service in this way has worried me enough that I’ve now gone and removed my data from the publicly searchable database. I’ll use the notification service instead.