5 ms·
If Troy authenticates the data, they can use that as an 'endorsement' when trying to sell it.
by richbell 2y ago
If Troy authenticates the data, they can use that as an 'endorsement' when trying to sell it.
- ianhawes 2y agoThis. Typically HIBP attribution includes the email of the "submitter". Various data aggregators will contact them and buy the stolen data. Everybody wins*. * Exceptions apply.
- Thorrez 2y agoWhere on HIBP can I see the email of the submitter?
- ramimac 2y agoIt's not available in this case, or every case. When available, you can search "The data was provided by" in https://haveibeenpwned.com/PwnedWebsites https://haveibeenpwned.com/PwnedWebsites
- Thorrez 2y agoThanks! Slight correction: only 2 breaches say "provided by" with a source, but a ton of breaches say "provided to" HIBP with a source.
- deleted 2y ago[deleted]
- RamRodification 2y agoDoesn't the value drop dramatically if it has already been shared with Troy and the HIBP database? Or is there a time frame where it has been authenticated by Troy but not yet added to the database?
- richbell 2y agoI don't think so. Troy isnt publicly sharing the credentials and that's what's valuable — especially having "exclusive" access. He blogged or tweeted about this at some point. Sadly, I can't find the link.
- divbzero 2y agoIs there a way to modify the HIBP reporting process to avoid aiding the sale of stolen data?