12 ms·

Have I Been Pwned 2.0

880 points by LorenDB 1y ago

deleted 1y ago
[deleted]
mNovak 1y ago
Is there a term for this trend in web design, with defaulting to dark mode and having slick gradients everywhere?
- aetherspawn 1y ago
  I think GitHub kinda did it first on their desktop home page, but that has been out for years.
  - MarcelOlsz 1y ago
    I feel like that was a subtype within the style that Stripe popularized.
  - burgerrito 1y ago
    I actually think I saw it on Linear (the issue tracker app) first. Who knows
  - rainonmoon 1y ago
    As someone who frequented a lot of video game-centric Invision Power Boards in the early 2000s, this is deeply insulting.
- kevinsundar 1y ago
  It was first popularized by Linear https://medium.com/design-bootcamp/the-rise-of-linear-style-design-origins-trends-and-techniques-4fd96aab7646 https://medium.com/design-bootcamp/the-rise-of-linear-style-...
  - SchemaLoad 1y ago
    Not sure which was first, but I associate this style a lot with Apple's product pages like https://www.apple.com/au/macbook-pro/ https://www.apple.com/au/macbook-pro/
- Brajeshwar 1y ago
  Not too far in the past, when Bootstrapped themes were becoming the face of the Internet, a new framework came to town — TailwindCSS. The smart thing they did was introduced the framework with a few brilliant template and a lot of styled components. I bought the initial copy and does a lot of people. Those templates, TailwindUI.com (now TailwindCSS.com/plus)[1] became the gradien-y, dark-ish, glow-y design you see a lot these days. A similar design wave is also happening with internal dashboard, admin interfaces. Thanks to https://ui.shadcn.com https://ui.shadcn.com Personally, I'm fine with the standardization of such functional interface designs. btw, for Have I Been Pwned, this is Bootstrap[2] and I'm not surprised it is also inheriting those design styles. 1. https://tailwindcss.com/plus https://tailwindcss.com/plus 2. https://getbootstrap.com https://getbootstrap.com
- kps 1y ago
  The term is ‘unreadable’. There are good reasons `:prefers-color-scheme` exists; use it.
standardUser 1y ago
It shows you a vertically scrolling timeline (with logos and blurbs) of all the data breaches that have exposed your email. How delightfully horrifying.
- MattSayar 1y ago
  Makes me feel a little powerless. The only thing I can really do is freeze my credit
  - SLWW 1y ago
    what? Why not just use different passwords for different things. I'd recommend something like privacy.com so you can generate a bunch of one-use cc cards when doing shopping on sites you don't trust and the like. Also don't willingly give up valuable personal information unless it's absolutely necessary, it's also not illegal to give online services outright false information (incorrect birthdates for example) which, in the event of a future data breach of that service, now at least those who would plan to benefit from your personal information might have some difficulties resetting important accs and the like. You just gotta be smart, it's not about being powerless, HIBP and the service is just one tool to make you aware of what's out there before it gets used against you. (I would highly recommend setting up notifications for important e-mail addresses)
    - XorNot 1y ago
      Application specific credit card numbers really needs to be a legally required thing. My card has been skimmed a couple of times and by far the most annoying part of the experience is having to reset and update regular accounts with the new number. Of course for online purchases the whole flow here should be inverted: businesses should just be registering against my payment provider directly, no account numbers involved (under the hood maybe have it be managed by ED25519 public keys for identity?) EDIT: while we're at it, why even have persistent numbers for in person cards? Let me tap it against my phone, invalidate the stored key from that time on, and generate a new one.
rasz 1y ago
Uncaught (in promise) Error: Invalid response from fetch: 401 - at emailSearch.ts:295:19 at async HTMLButtonElement.<anonymous> (emailSearch.ts:43:23)
dsissitka 1y ago
> But now it's on a timeline you can scroll through in reverse chronological order, with each breach summarising what happened. Maybe I'm reading it wrong but it looks like it might be a little off. I get: - October 2013 - June 2008 - ...a bunch more... - November 2021 - December 2020
- dandellion 1y ago
  Not only is not in order, I tried a few emails and in all of them I get a bunch of sites that I've never used. I wonder if it's fetching the wrong data?
  - kbrosnan 1y ago
    I regularly have doppelgangers that sign up for services with my email address. I've been added to door/visitor notifications. I have received medical information for them. Retirement package info. A telecom internal tracker. A Doubleclick account for a while. Lessons for their children. Countless rewards accounts.
    - gpm 1y ago
      This has literally never happened to me... is your email address "go@away.com" or something?
      - addandsubtract 1y ago
        I also checked my throwaway gmail and it was included in a French Citizen leak [1]. I'm neither French, nor do I have any other connection to France. Not sure why my email would be included there, except for some random using my email (or misspelling theirs) – it's [5-7 letter english word][number] at gmail. [1] https://haveibeenpwned.com/breach/FrenchCitizens https://haveibeenpwned.com/breach/FrenchCitizens
      - kbrosnan 1y ago
        First initial last name at gMail is one.
AdamH12113 1y ago
Amazing that even within the last decade a site as large as LinkedIn could be storing unsalted passwords. How does anyone fail at this in the modern era?
- mschuster91 1y ago
  > How does anyone fail at this in the modern era? Most probably some ancient legacy mainframe or whatnot other integration that nobody really has the time and budget to clean up and migrate to something more modern. The larger the company, the larger the risk for ossification of anything deemed "business critical" because even a minuscule outage of one hour now is six if not seven figures worth of "lost" time.
  - fwip 1y ago
    LinkedIn isn't old enough to have anything ancient. It was launched in 2003, and even then you'd get laughed at for suggesting storing passwords in plaintext.
    - Sohcahtoa82 1y ago
      Plaintext, sure, but it was certainly common still to use SHA-256 which is very quickly cracked if your password is short.
    - bongodongobob 1y ago
      Doesn't mean that the infra is still ancient. What I see a lot is tech debt from migrations. Lots of times both the old and new systems have to work together for a period of time, so you leave certain legacy protocols and flags in place for the transition period and then the new system is never fully "updated" to the new standards. Pre win2k AD, file path lengths, encryption protocols, etc etc. Sure, the new system is "up to date" but the old compatibility settings remain.
      - malfist 1y ago
        This is also how feature flag services become mission critical because everything gets launched behind feature flags that never get cleaned up
85392_school 1y ago
Does anyone else feel like the new design feels less trustworthy? I've probably just been conditioned on too many templates that all look the same, and there's nothing inherently wrong with it, yet it makes me wonder if I've accidentally opened a ripoff instead of the real thing.
- pocketarc 1y ago
  No, I agree. This new version looks like someone using a cheap template with cheap gradients (I don’t know how else to describe the gradients), and it immediately makes it look less trustworthy.
  - deleted 1y ago
    [deleted]
- Y_Y 1y ago
  Yes. Maybe I'm just a grumpy old man, but I think website redesigns are just a marketing thing (and fun for web developers) and rarely benefit the user. Nasa ADS has a fantastic (if super old-looking) site for many years that was clean and fast and did the job, they spent a lot of time and effort jazzing it up with pictures and javascript, and now it still just does the same thing.
- GreenWatermelon 1y ago
  It also has horrible performance and hikacks scroll. The site feels horrendous.
nipperkinfeet 1y ago
Too much scrolling. I prefer the old page.
- gpi 1y ago
  Feels like doom scrolling
  - grg0 1y ago
    It also scrolls like shit if you happen to be on a GPU not made in the last 10 years.
    - GreenWatermelon 1y ago
      Or on a phone.
- adrianmonk 1y ago
  They could preserve the same basic concept but scrunch it vertically a lot. Right now, the tiles in each column are spaced out so much that if you moved them all into one column, they wouldn't overlap. Instead, they could stagger them. Some blank space would still make it easier to understand visually, just not as much. If they did this, it would be a bit harder to see how which date-circle on the timeline corresponds to which tile, but that could be fixed somehow, like a dotted line that joins a tile to its circle or by moving the circle to one side of the center line. They could also shrink the contents of the tiles themselves. (1) There's no reason to have MORE space after "Compromised data:" than before it. It wastes space, and (IMHO) aesthetically it looks very awkward and clumsy. (2) Personally, I'd also not double-space the bullet items. I can see how it adds emphasis, but it wastes a lot of space and to me it looks bad. (3) Too much vertical space above the "View Details" button. Sure, some padding is nice, but why so much more here than between the icon (at the top of the tile) and the first paragraph?
mslev 1y ago
The new design looks great, and I always love following Troy's updates (although sometimes with semi-morbid curiosity). I do find the timeline to be a little confusing- it seems to be ordered from earliest breach to most recent, but the dates on the timeline don't match that, as they seem to be when the data was leaked? Display: breach date Ordering: breach published date? I think it might be clearer to order + display the published date, and in the cards themselves show the breach date in a standard way.
CobrastanJorji 1y ago
Very cool. Small bug report: I've been pwnd a few dozens times, and my timeline is not in calendar order. I see Adobe (October 2013), then LinkedIn (May 2012), then Dropbox (June 2012), then Lastfm (March 2012), then some 2016 ones, then Kickstarter in 2014, and then after that they start being more in order of the listed dates.
- Casteil 1y ago
  Might be related to the 'breach disclosed/discovered' date? I noticed some of mine appeared out of chronological order, too.
neilv 1y ago
He should partner with a law firm, for class action lawsuits, for every breach due to negligence (which is probably all of them). Tie in to a banking service, so you can do direct deposits to many millions of people, every time there's new settlements paid, and you'll be a folk hero. Get lawyers who want negligent companies to actually regret the breaches, with judgements that hurt. (Rather than a small settlement that gets lawyers paid, but is only a small cost of doing business, which is preferable to doing business responsibly.) Optional: Sell data of imminent lawsuits, to an investment firm. Though, ideally, investors won't need this data, since everyone will know that a breach means a stock should take a hit. Isn't that how it should be.
- nyokodo 1y ago
  > do direct deposits to many millions of people, every time there's new settlements paid I wish I could easily donate my tiny settlements to a good cause. It might make it worth the time to register for the class.
  - Covzire 1y ago
    I'd donate a bit to make this a reality if someone had a chance at pulling such a service off.
  - Avicebron 1y ago
    Probably impossible, but create a slush fund where companies that behave badly are forced to pay into so we can do things like fix roads and build housing.
    - idiotsecant 1y ago
      Wow I think you just launched a political party I would vote for
      - hx8 1y ago
        Fine companies to fund bridges.
charcircuit 1y ago
This new design no longer links to the pastebins you were included in.
- jpopesculian 1y ago
  It does at the very bottom of the list for me
  - charcircuit 1y ago
    For me it only shows a list of them and none of them are clickable.
tech234a 1y ago
I regularly use plus codes on my email addresses when I sign up for services, is there a way to search for an email address and all associated plus codes? Last I checked I couldn’t find that functionality.
- jsheard 1y ago
  If you use a custom domain, in the dashboard you can claim the whole domain and then see every breach for every address under it. Otherwise I don't think so.
Buttons840 1y ago
A lot of companies I've never heard of before are leaking my data. :( Can we make it so that companies I've never heard of before don't have my data in the first place?
- lovich 1y ago
  My latest one was from these guys https://www.eye4fraud.com/ https://www.eye4fraud.com/ who I have never knowingly done business with. Almost too absurd to be true
- immibis 1y ago
  [flagged]
diggan 1y ago
Who has the record for being in the most breaches? My main email seems to currently be in 40 breaches, earliest one in from June 2011 (HackForums, don't even remember what that is), and last one in September 2024 (FrenchCitizens, although I'm not French nor have I ever lived in France).
- montag 1y ago
  You’ve got me beat by 1. Congratulations
  - coolcase 1y ago
    [flagged]
- mtmail 1y ago
  john@yahoo.com is in 322 breaches.
  - aaronharnly 1y ago
    This is fun. john@hotmail.com has 340!
    - bazmattaz 1y ago
      John@gmail.com has 395!
      - MyPasswordSucks 1y ago
        John really needs to get his shit together.
- edm0nd 1y ago
  HackForums is a popular skid forum ran by an FBI informant who lives in Vegas
- Brajeshwar 1y ago
YPPH 1y ago
For those who would prefer to stay a little more under the radar, you can hide results from a search of your email appearing on this service. https://haveibeenpwned.com/OptOut https://haveibeenpwned.com/OptOut
- cypherpunks01 1y ago
  Thanks for the info! For anyone considering, here are the 3 opt-outions that appear after you email verify: 1. Just remove my email address from public search No one using the public HIBP search feature will be able to see your email address in the results. You’ll still be able to search your own address through the notification service, which verifies that you control the email before showing any results. If your email is part of a domain monitored by someone else (e.g., your employer), the domain controller will still be able to see it in domain-level searches. 2. Remove my email address from public search and delete the list of breaches it appears in Your email address is no longer searchable — neither through the public service nor by you, even if you verify ownership — because the associated breaches have been deleted from the database. However, your email address is still retained by HIBP to ensure it is excluded from any future breaches and not added to your record. 3. Delete my email address completely The record containing your email address will be completely deleted, meaning it will no longer appear in search results — for you or the public — at the time of deletion. However, if your email address appears in future data breaches, it will become publicly searchable again, as the opt-out record itself has also been deleted.
- coolcase 1y ago
  What if the opt out list gets pwned?
  - eddythompson80 1y ago
    I assume if that ever happens, someone will register https://haveibeenpwnedbyhaveibeenpwned.com https://haveibeenpwnedbyhaveibeenpwned.com. It'll be the top post of HN for a couple of says while everyone argues in the comments about how the state of online security is "fundamentally broken" while someone asks if they can sue. Then we'll all forget and move on.
h1fra 1y ago
nit: timeline should be most recent to least recent
rtrgrd 1y ago
Am I the only one who is experiencing severe lag when scrolling on the new site (Firefox android)?
- GreenWatermelon 1y ago
  Same here. Also Firefox Android.
havingapoo 1y ago
[flagged]
jmward01 1y ago
This is a great site. Thanks for making it! I wish governments would take this kind of thing seriously though. Identity theft/stealing accounts/etc etc all starts with breaches like this and in the modern world it is often less devastating to have someone break into your house than to break into your digital life. With a break in you will get actual support in the form of a phone number to call (911 in the US) and real people doing real work to track down who did it and stop them. With the digital world you have nobody to call and even if you did I doubt much followup would happen. Society needs to change gears on this stuff and actually take it seriously.
nikcub 1y ago
Lots of regular people use Have I Been Pwned and sending them to 1Password is probably the single best thing you could do for them (I know it's a sponsorship - but it's a very complimentary one). I'd make the language around that promo banner stronger (ie. "We strongly recommend") and make it stand out more on the page. So many social media accounts get hacked[0] because of shared passwords and those affected users often end up on the site - funnelling them to a password manager and a reason why it's good hygiene is great. ps. congrats on the relaunch! [0] I've probably assisted 20+ such cases in the past ~12 months
- bloqs 1y ago
  Why not bitwarden?
- tallanvor 1y ago
  It's a sponsorship, so I'm not complaining, but if the goal was really to get people to use a password manager he would be sending them to Bitwarden since they have a free plan, plus their paid plan is only $10/year compared to $36 for 1Password.
  - diggan 1y ago
    Besides the pricing, is there any reason to prefer Bitwarden over 1Password? Been happily using 1Password for some years, never had any issues, but maybe I'm glossing over anything? Probably the cli interface (`op`) is the one feature I couldn't live without today.
    - MattSteelblade 1y ago
      Open-source versus proprietary and the option to self-host are the two that immediately come to mind.
      - atonse 1y ago
        I can't speak about the other password managers, but 1Password's architecture ensures even 1Password can't see any of your credentials. It's E2E Encrypted. I've been a 1Password user for over a decade. It's user friendly, and I'd rather not have the responsibility to self-host my company and extended family's credentials.
bix6 1y ago
Awesome! My timeline is showing out of order though (starts with a 2013 then a 2019 then a 2011).
glandium 1y ago
There's something interesting in the domain search: some breaches contain addresses that... simply don't exist. Like B2BUSABusinesses has sales@mydomain.
luchris429 1y ago
I love this site! Though I do wonder how much this site also helps amateur hackers find where to search for a specific person's password. One way to deal with it could be to email the person their pwns.
- edm0nd 1y ago
  As a security researcher who is into OSINT, HIBP is my first go to when obtaining an email address of interest. If it's found, it immediately helps me know which leaked DBs to go grep through and find more info about the target email addy. Obtaining and storing TBs of leaked databases is another part of the puzzle that is always growing and a bit more complex.
deleted 1y ago
[deleted]
johnklos 1y ago
I really wish Troy would've put a little more thought in to this before deciding to host using a for-profit corporation based in the US that wants to be a monopoly. Will Cloudflare sell data to US TLA agencies? Probably.
hanatanaka1984 1y ago
Great service. I use regularly with extended family to convince use of MFA.
- lynnharry 1y ago
  In our country, email has never been widely adopted among non-tech-savvy citizens. SMS verification remains the most popular—and likely safer—method.
Saris 1y ago
I really wish I could put in my domain name, I have so many aliases that it's basically impossible to search each one individually.
- flas9sd 1y ago
  it's right there after the "The Domain Search Feature" heading. Verify ownership, then you get results
  - Saris 1y ago
    Ahh I see it on the footer of the website, a bit hidden! I'm not sure I really need it for personal use, more just a cool thing to see, so I'm a bit undecided on paying for the domain feature. I can see it being useful for a business though where each email is a different employee dealing with accounts everywhere.
    - aaronharnly 1y ago
      You can pay for just one month at a time. I pay now and then and check in on my personal domain – like you, I use dozens of email addresses with a catchall.
      - ohhnoodont 1y ago
        The first tier ($4/month) only works for up to 25 aliases. Depending on how many of your aliases have leaked, you may have to pay a lot to perform that check. I wish HIBP had a solution for those of us who are individuals but use domain catchall forwarding as our method for separating accounts. It feels good to see adobe@mydomain.com, newrelic@mydomain.com, internetarchive@mydomain.com, etc. there but not any of the addresses I use for normal communication.
        cbull 1y ago
        Agree completely. I got ownership of my domain before he started charging, but looking now there's only a summary and it lists 45 email addresses in breaches, which means I need to pay a substantial amount to get a report, and I'm the only user of the domain for email. I wish there was a "I'm just one person, or a small family" tier for this.
geor9e 1y ago
The input box doesn't work
BubbleRings 1y ago
I’ve never been able to figure out how haveibeenpwned.com can be useful to me, since I have had the same email address for many years and I don’t want to give it up. Do people get a new primary email address every time their address shows up in a breach list like haveibeenpwned ?
- MarioMan 1y ago
  It's more than just the email. If you're in the breach, it might now publicly tie your email to things like your real name. You also have to worry if you reuse passwords (which you shouldn't do even if you haven't been in a breach), because now the password in the breach is known to be used with that email address, and attackers will pivot to other services to try those same credentials elsewhere.
- gerdesj 1y ago
  Your identity isn't a problem! Its the password bit.
  - akimbostrawman 1y ago
    Until it is https://en.wikipedia.org/wiki/Ashley_Madison_data_breach https://en.wikipedia.org/wiki/Ashley_Madison_data_breach Using different random email aliases for each service is as much best practice as is different random passwords.
- salomonk_mur 1y ago
  They change their passwords...
- paranoidrobot 1y ago
  For personal use: To know what services you use have been breached. You can then follow it up with ensuring you rotate the password on that site/service. If they have other PII of yours, it's a heads up that scammers might target you and/or your family with that information. For work use: To monitor which sites/services employees use with work email addresses, and use it as a reminder/re-enforcement that they should rotate credentials used on that service, and if they're reusing them at work - to change there, too.
msephton 1y ago
Interestingly, the timeline is not chronological for me? I can't seem to figure it out the order it is in.
curtisszmania 1y ago
[dead]
willmarquis 1y ago
Really impressive evolution of a crucial service. The architectural and UX improvements are well thought out, especially the focus on resilience and scalability. Love the transparency around the decision-making process, too-Troy’s commitment to keeping HIBP fast, free, and useful is a great example of public-interest software done right. The migration to .NET 8 and use of Cloudflare for caching shows how mature and modern the stack is becoming.
deleted 1y ago
[deleted]
benob 1y ago
Ok, one of my email addresses is in a bunch of leaks. What is interesting is that most services on this list I have never used. How did they get my email in the first place? What is the accuracy of that whole business?
WhereIsTheTruth 1y ago
It's funny how you can find someone's interests just by typing his/her email address The ultimate tracking tool
kmarc 1y ago
The ';-- in front of Pwned is a brilliant idea but less brilliant execution. Missed opportunity, I'm wondering how many people don't realize what it is
- mindwok 1y ago
  I definitely know what it is but for those who don’t what would you tell them
  - adhamsalama 1y ago
    I think it's an SQL injection.
  - florbnit 1y ago
    Relevant xkcd: https://xkcd.com/327/ https://xkcd.com/327/
- flysand7 1y ago
  Oh that's what it was! I actually didn't think much of it until you pointed it out. At a glance looked like some random arrangement of squares
- addandsubtract 1y ago
  Oh, I thought it was the loss meme.
micw 1y ago
Unfortunately the new UI does not allow to search for leaked phone numbers anymore. The old did (e.g. could check for facebook phone number leak, see https://www.troyhunt.com/the-facebook-phone-numbers-are-now-searchable-in-have-i-been-pwned/ https://www.troyhunt.com/the-facebook-phone-numbers-are-now-...). The new does not let it pass through the input field. Edit: it's also statet in the announcement: > Just one little thing first - we've dropped username and phone number search support from the website But it's really a bad time to remove this feature since there's a ongoing law suite against facebook in germany (https://www.vzbv.de/pressemitteilungen/facebook-datenleck-betroffene-koennen-sich-der-sammelklage-des-vzbv-anschliessen https://www.vzbv.de/pressemitteilungen/facebook-datenleck-be..., hgerman link) that utilized the search there to know if one can participate or not.
- FinnKuhn 1y ago
  The API still supports it so it should still be possible to implement a new solution for it. The reasons for dropping the feature as outlined in the announcement seem very reasonable to me considering the larger implications.
xlbuttplug2 1y ago
Now waiting for this website to get pwned for its search history so hackers can identify targets worth pursuing.
yieldcrv 1y ago
Too bad the term pwned dates us now I think we’re backed to hacked
stevekemp 1y ago
Like many people I have a "main" email address, and I use per-company addresses for almost everything else. Now that the domain-searches require subscriptions this site has become much less useful. I just added my domain to the site again and I see "2,243 Total Breached Addresses", and "18 Addresses excluding Spam Lists", but I have no idea what they are. Attempting to click the links shows me I need to "upgrade" to see them, and the download of excel and JSON result in 404 errors. Too bad, I guess if you have only a single email address it might be good to get informed, but if you use a domain with multiple addresses it's way less useful.
- flurdy 1y ago
  I have quite a few personal catch-all domain names, and two of the main ones are used for the per website alias as you do, so over a decade and longer later, I would never be able to manually enter each address. Or remember them. And yes, the subscribe restrictions for domain searches are annoying. But Troy and family also need to eat, so I understand the need for a payment part, especially for companies. We just ended up in the grey zone in between. I wish there were some more nuances, but then again, HIBP can't cater for every edge case unless they want to hire lots of devs and customer services. I ended up signing up for a subscription, checked my domains, and then cancelled the subscription. It felt a little cumbersome, but ok. A non-recurring 2-day access would have worked for me...
- diggan 1y ago
  I have a similar setup, and also use lots of addresses at one domain. But I'm not subscribed (as far as I know) and I can do a wildcard search at my domain without issues, and also see exactly what emails been leaked. I don't see what leaks they're part of, but that feels less relevant, I already know where it got leaked as each email is for one product/project/company.
- tiffanyh 1y ago
  Is your per-company addresses a derivation of your main email address? If so, this is called “email tumbling” and services exist to strip the “per-company” part to expose your main email.
gherkinnn 1y ago
https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords Checking the passwords, "password" has been pwned >21 million times. I don't know what I expected.
bstsb 1y ago
i like the new design, but it feels that the "stats" like the cache hit ratio and edge locations won't matter to the vast majority of visitors, who are just trying to check for potential breaches. on the other hand, they will be great for the api/business pages
Squeeeez 1y ago
Does anyone feel like paying $274 and checking if the domains search allows gmail, hotmail etc? :o)
- TonyTrapp 1y ago
  I signed up for domain search when it was still free. It requires verifying an email address that you shouldn't have access to, unless the email service in question is not set up according to RFCs.
BurnGpuBurn 1y ago
1) The search function has disappeared from the home page. 2) When clicking "details" on one of the search results, and then the back button, the search results disappear. 3) Other than that, thanks man great service!
randunel 1y ago
New HIBP, same old restriction banning users from 3rd world countries https://imgur.com/a/AzNSreV https://imgur.com/a/AzNSreV
- Y_Y 1y ago
  "Have I been pwned... at birth, by accidents of geography and economics" Sorry that's happened to you. The only remedy I can think of is get a non-commercial proxy in some "recommended" country like through a friend.
- skarz 1y ago
  VPN?
greatgib 1y ago
I was always frustrated by this service because it is good to tell you that you have been pwned and your email appears in a breach but sadly it is more often than not more scary than useful as you can't see exactly what has been leaked about you. Especially your password. I understand the rational to hide the details, but bad actors like criminal probably have the source file with the details anyway. What annoys me is that it is good to know that your email appears in a random pastebin agglomerating hundreds of leaks but if they don't give the exact name and date of the site, and without seeing the password it is hard to know who leaked your data and which password to change. The worse is that I was used to use a very shitty simple password for all the sites that ask one without needing one (let's say media with free subscription needed to read a single article, Free conference or online webinar), ... and these one are the best targets to have leaks despite them being totally harmless if you take care to not give your personal info inside.
robertlagrant 1y ago
I just very much appreciate a regular gaming typo having made such a cultural impact over the last 25 years.
keybored 1y ago
> The AI > I wanted to make a quick note of this here, as AI seems to be either constantly overblown or denigrated. This just gestures at middle-of-the-road thinking. So what’s this begrudging note about? To set us on the correct course in the middle of the road? > I'd say it was right 90% of the time, too, and if you're not using AI aggressively in your software development work now (and I'm sure there are much better ways, too) I'm pretty confident in saying "you're doing it wrong". Well done. AI plug done. I don’t see how that statement fulfills the implied middle-of-the-road opinion though.
Aachen 1y ago
> It's likely a single-digit percentage of requests that are real humans being [blocked], and we need to look at ways to get that number down, but at least the fallback positions are improved now. The fallback suggestions mentioned in the article are "try clicking the box again" and "try reloading the page" I'm slowly starting to wonder if I should start sending snail mail to companies that block me, instead of resigning to go somewhere else. HIBP is a free web service and shops have no obligation to serve a given individual, but it everyone puts CloudFlare Turnstile, Google Recaptcha, etc. in front of their services, a "single-digit percentage" of people simply cannot participate in modern society. Similar markers (IP address misclassified as bot range, unusual/old/infected browser, ...) will constantly be triggering for the same group
- whizzter 1y ago
  Agreed, it seems like my (fixed) IP address is triggering Google and CF for some reason. I don't run any scrapers or so from home but do use NoScript, am I a bot for using NoScript? Perhaps.
  - jacekm 1y ago
    Yeah, I have rather aggressive blocking on with uBlock Origin. Google started blocking me about a month ago, I have to solve captcha for literally every query. I know it's uBlock as things are back to normal when I disable it. Well, this helps me to learn new muscle memory to rely on DuckDuckGo and Brave Search instead.
- Aachen 1y ago
  6 hours later, case in point... I'm blocked logging into Slack due to an invisible captcha: https://snipboard.io/h1E86S.jpg https://snipboard.io/h1E86S.jpg I was surprised I was failing to type this code over from my email but no, that wasn't the issue. In the developer tools, the server fesses up I'm detected as "bot" again. As it's an invisible process, there's nothing I can do about it. This is a clean browser because it's for pentesting websites at work. No add-ons installed, no uBlock, no noscript, no corporate configuration, nothing
- 1y ago
l72 1y ago
I use a lot of email+site@example.com. It would be great if those were included too!
santiagobasulto 1y ago
When it mentions that your password has been leaked for a service, is this the plain text pwd (that service somehow stored that way) or is it a hash? Was the website salting the passwords (so no rainbow-table attack could happen)? What key derivation function were they using? Etc... I feel the red circle with "Password compromised" is way too simplistic if this wants to be a TRUE trusty site regarding cybersecurity. If they just want to show fear and sell 1Password ads, I understand it, I won't consult it anymore. But if they want to really step up their game from a technical perspective, they should include more details.
- fckgw 1y ago
  Every detailed blurb on the breach that I've seen says "Passwords stored as" and lets you know how they were encrypted.
- slumberlust 1y ago
  I'm not convinced the target audience is infosec. I've leveraged this site a few times to show family members the pervasiveness of breaches and to recommend pw managers. If a tool like this can help a few people increase their posture then I consider it a success.
brightball 1y ago
Does it feel like this site is itself a vulnerability? It seems like being able to go type in anybody's email address and just get a list of sites where it was found would be part of an OSINT process. Shouldn't it at least send you a link to verify that you control the address before showing your results?
- pixxel 1y ago
  [dead]
- replwoacause 1y ago
  I felt the exact same way. Especially because I saw my email had been registered and leaked by some seedy looking conservative news site full of Trump propaganda. I always knew people could sign others up for junk "malicious subscriptions" and suspected that is what happened when I would get this trash in my inbox, but now seeing that other people can also see it very publicly is disturbing. How are they to know I didn't sign up for this myself? I'd hate to think people were thinking that about me. EDIT: Seems like https://haveibeenpwned.com/OptOut https://haveibeenpwned.com/OptOut does the trick.
- upcoming-sesame 1y ago
  I guess the assumption is that bad actors have access to the data anyway so putting such verification process is not deterring any bad actor in any way
- whatamidoingyo 1y ago
  This is indeed a part of an OSINT process. Always has been.
- remus 1y ago
  > Does it feel like this site is itself a vulnerability? It seems like being able to go type in anybody's email address and just get a list of sites where it was found would be part of an OSINT process. I think it is a reasonable trade-off. For non-technical people (i.e. ~everyone) it provides a really useful service where you can see if your data has been leaked and what passwords to reset. For bad guys it makes their lives a little easier by creating a quick lookup and potentially knowledge about some leaks they weren't aware of, but ultimately there'd be a dark web version if HIBP didn't exist. I think there's also a lot of PR value in a site like HIBP. If a non-technical person sees a headline like "400 million customer records leaked by Big Corp" it feels pretty abstract, but if you go and type your email address into HIBP and see a list of companies who have leaked your email address (and most likely some other data) it feels more personal.
giancarlostoro 1y ago
I keep wondering if its smart to just roll over an email address when it gets compromised, and limit your exposure, as well as force you to change your password while you're on every website ditching your former email. I know some people use email tags, but maybe just rolling a new email might be better, followed by deleting unused dead accounts you will never use again.
paulnpace 1y ago
I just verified that this database does not include the Vultr breach, or, at least it does not include email addresses that are unique to the Vultr service.
- paulnpace 1y ago
  Geez, and they have one of my domains with an address claiming to have been compromised by "B2B USA Businesses" in a leak in mid-2017, which is over a year before the domain was registered.
skarz 1y ago
What's the best service or app for tracking data breaches where your username and password are leaked? I'm trying to mitigate some leaks through ProtonPass but it's very frustrating as they simply say "password ****123 was found on the dark web" (they actually redact the full password) so then I manually have to go through my 100+ passwords and look for that particular password.
appleaday1 1y ago
Lol I was looking at recently or yesterday and was wondering why it looked more nicer and usable than usual heh.

880 points by LorenDB 1y ago

deleted 1y ago

[deleted]

mNovak 1y ago

Is there a term for this trend in web design, with defaulting to dark mode and having slick gradients everywhere?

aetherspawn 1y ago
I think GitHub kinda did it first on their desktop home page, but that has been out for years.
- MarcelOlsz 1y ago
  I feel like that was a subtype within the style that Stripe popularized.
- burgerrito 1y ago
  I actually think I saw it on Linear (the issue tracker app) first. Who knows
- rainonmoon 1y ago
  As someone who frequented a lot of video game-centric Invision Power Boards in the early 2000s, this is deeply insulting.
kevinsundar 1y ago
It was first popularized by Linear https://medium.com/design-bootcamp/the-rise-of-linear-style-design-origins-trends-and-techniques-4fd96aab7646 https://medium.com/design-bootcamp/the-rise-of-linear-style-...
- SchemaLoad 1y ago
  Not sure which was first, but I associate this style a lot with Apple's product pages like https://www.apple.com/au/macbook-pro/ https://www.apple.com/au/macbook-pro/
Brajeshwar 1y ago
Not too far in the past, when Bootstrapped themes were becoming the face of the Internet, a new framework came to town — TailwindCSS. The smart thing they did was introduced the framework with a few brilliant template and a lot of styled components. I bought the initial copy and does a lot of people. Those templates, TailwindUI.com (now TailwindCSS.com/plus)[1] became the gradien-y, dark-ish, glow-y design you see a lot these days. A similar design wave is also happening with internal dashboard, admin interfaces. Thanks to https://ui.shadcn.com https://ui.shadcn.com Personally, I'm fine with the standardization of such functional interface designs. btw, for Have I Been Pwned, this is Bootstrap[2] and I'm not surprised it is also inheriting those design styles. 1. https://tailwindcss.com/plus https://tailwindcss.com/plus 2. https://getbootstrap.com https://getbootstrap.com
kps 1y ago
The term is ‘unreadable’. There are good reasons `:prefers-color-scheme` exists; use it.

standardUser 1y ago

It shows you a vertically scrolling timeline (with logos and blurbs) of all the data breaches that have exposed your email. How delightfully horrifying.

MattSayar 1y ago
Makes me feel a little powerless. The only thing I can really do is freeze my credit
- SLWW 1y ago
  what? Why not just use different passwords for different things. I'd recommend something like privacy.com so you can generate a bunch of one-use cc cards when doing shopping on sites you don't trust and the like. Also don't willingly give up valuable personal information unless it's absolutely necessary, it's also not illegal to give online services outright false information (incorrect birthdates for example) which, in the event of a future data breach of that service, now at least those who would plan to benefit from your personal information might have some difficulties resetting important accs and the like. You just gotta be smart, it's not about being powerless, HIBP and the service is just one tool to make you aware of what's out there before it gets used against you. (I would highly recommend setting up notifications for important e-mail addresses)
  - XorNot 1y ago
    Application specific credit card numbers really needs to be a legally required thing. My card has been skimmed a couple of times and by far the most annoying part of the experience is having to reset and update regular accounts with the new number. Of course for online purchases the whole flow here should be inverted: businesses should just be registering against my payment provider directly, no account numbers involved (under the hood maybe have it be managed by ED25519 public keys for identity?) EDIT: while we're at it, why even have persistent numbers for in person cards? Let me tap it against my phone, invalidate the stored key from that time on, and generate a new one.

rasz 1y ago

Uncaught (in promise) Error: Invalid response from fetch: 401 - at emailSearch.ts:295:19 at async HTMLButtonElement.<anonymous> (emailSearch.ts:43:23)

dsissitka 1y ago

> But now it's on a timeline you can scroll through in reverse chronological order, with each breach summarising what happened. Maybe I'm reading it wrong but it looks like it might be a little off. I get: - October 2013 - June 2008 - ...a bunch more... - November 2021 - December 2020

dandellion 1y ago
Not only is not in order, I tried a few emails and in all of them I get a bunch of sites that I've never used. I wonder if it's fetching the wrong data?
- kbrosnan 1y ago
  I regularly have doppelgangers that sign up for services with my email address. I've been added to door/visitor notifications. I have received medical information for them. Retirement package info. A telecom internal tracker. A Doubleclick account for a while. Lessons for their children. Countless rewards accounts.
  - gpm 1y ago
    This has literally never happened to me... is your email address "go@away.com" or something?
    - addandsubtract 1y ago
      I also checked my throwaway gmail and it was included in a French Citizen leak [1]. I'm neither French, nor do I have any other connection to France. Not sure why my email would be included there, except for some random using my email (or misspelling theirs) – it's [5-7 letter english word][number] at gmail. [1] https://haveibeenpwned.com/breach/FrenchCitizens https://haveibeenpwned.com/breach/FrenchCitizens
    - kbrosnan 1y ago
      First initial last name at gMail is one.

AdamH12113 1y ago

Amazing that even within the last decade a site as large as LinkedIn could be storing unsalted passwords. How does anyone fail at this in the modern era?

mschuster91 1y ago
> How does anyone fail at this in the modern era? Most probably some ancient legacy mainframe or whatnot other integration that nobody really has the time and budget to clean up and migrate to something more modern. The larger the company, the larger the risk for ossification of anything deemed "business critical" because even a minuscule outage of one hour now is six if not seven figures worth of "lost" time.
- fwip 1y ago
  LinkedIn isn't old enough to have anything ancient. It was launched in 2003, and even then you'd get laughed at for suggesting storing passwords in plaintext.
  - Sohcahtoa82 1y ago
    Plaintext, sure, but it was certainly common still to use SHA-256 which is very quickly cracked if your password is short.
  - bongodongobob 1y ago
    Doesn't mean that the infra is still ancient. What I see a lot is tech debt from migrations. Lots of times both the old and new systems have to work together for a period of time, so you leave certain legacy protocols and flags in place for the transition period and then the new system is never fully "updated" to the new standards. Pre win2k AD, file path lengths, encryption protocols, etc etc. Sure, the new system is "up to date" but the old compatibility settings remain.
    - malfist 1y ago
      This is also how feature flag services become mission critical because everything gets launched behind feature flags that never get cleaned up

85392_school 1y ago

Does anyone else feel like the new design feels less trustworthy? I've probably just been conditioned on too many templates that all look the same, and there's nothing inherently wrong with it, yet it makes me wonder if I've accidentally opened a ripoff instead of the real thing.

pocketarc 1y ago
No, I agree. This new version looks like someone using a cheap template with cheap gradients (I don’t know how else to describe the gradients), and it immediately makes it look less trustworthy.
- deleted 1y ago
  [deleted]
Y_Y 1y ago
Yes. Maybe I'm just a grumpy old man, but I think website redesigns are just a marketing thing (and fun for web developers) and rarely benefit the user. Nasa ADS has a fantastic (if super old-looking) site for many years that was clean and fast and did the job, they spent a lot of time and effort jazzing it up with pictures and javascript, and now it still just does the same thing.
GreenWatermelon 1y ago
It also has horrible performance and hikacks scroll. The site feels horrendous.

nipperkinfeet 1y ago

Too much scrolling. I prefer the old page.

gpi 1y ago
Feels like doom scrolling
- grg0 1y ago
  It also scrolls like shit if you happen to be on a GPU not made in the last 10 years.
  - GreenWatermelon 1y ago
    Or on a phone.
adrianmonk 1y ago
They could preserve the same basic concept but scrunch it vertically a lot. Right now, the tiles in each column are spaced out so much that if you moved them all into one column, they wouldn't overlap. Instead, they could stagger them. Some blank space would still make it easier to understand visually, just not as much. If they did this, it would be a bit harder to see how which date-circle on the timeline corresponds to which tile, but that could be fixed somehow, like a dotted line that joins a tile to its circle or by moving the circle to one side of the center line. They could also shrink the contents of the tiles themselves. (1) There's no reason to have MORE space after "Compromised data:" than before it. It wastes space, and (IMHO) aesthetically it looks very awkward and clumsy. (2) Personally, I'd also not double-space the bullet items. I can see how it adds emphasis, but it wastes a lot of space and to me it looks bad. (3) Too much vertical space above the "View Details" button. Sure, some padding is nice, but why so much more here than between the icon (at the top of the tile) and the first paragraph?

mslev 1y ago

The new design looks great, and I always love following Troy's updates (although sometimes with semi-morbid curiosity). I do find the timeline to be a little confusing- it seems to be ordered from earliest breach to most recent, but the dates on the timeline don't match that, as they seem to be when the data was leaked? Display: breach date Ordering: breach published date? I think it might be clearer to order + display the published date, and in the cards themselves show the breach date in a standard way.

CobrastanJorji 1y ago

Very cool. Small bug report: I've been pwnd a few dozens times, and my timeline is not in calendar order. I see Adobe (October 2013), then LinkedIn (May 2012), then Dropbox (June 2012), then Lastfm (March 2012), then some 2016 ones, then Kickstarter in 2014, and then after that they start being more in order of the listed dates.

Casteil 1y ago
Might be related to the 'breach disclosed/discovered' date? I noticed some of mine appeared out of chronological order, too.

neilv 1y ago

He should partner with a law firm, for class action lawsuits, for every breach due to negligence (which is probably all of them). Tie in to a banking service, so you can do direct deposits to many millions of people, every time there's new settlements paid, and you'll be a folk hero. Get lawyers who want negligent companies to actually regret the breaches, with judgements that hurt. (Rather than a small settlement that gets lawyers paid, but is only a small cost of doing business, which is preferable to doing business responsibly.) Optional: Sell data of imminent lawsuits, to an investment firm. Though, ideally, investors won't need this data, since everyone will know that a breach means a stock should take a hit. Isn't that how it should be.

nyokodo 1y ago
> do direct deposits to many millions of people, every time there's new settlements paid I wish I could easily donate my tiny settlements to a good cause. It might make it worth the time to register for the class.
- Covzire 1y ago
  I'd donate a bit to make this a reality if someone had a chance at pulling such a service off.
- Avicebron 1y ago
  Probably impossible, but create a slush fund where companies that behave badly are forced to pay into so we can do things like fix roads and build housing.
  - idiotsecant 1y ago
    Wow I think you just launched a political party I would vote for
    - hx8 1y ago
      Fine companies to fund bridges.

charcircuit 1y ago

This new design no longer links to the pastebins you were included in.

jpopesculian 1y ago
It does at the very bottom of the list for me
- charcircuit 1y ago
  For me it only shows a list of them and none of them are clickable.

tech234a 1y ago

I regularly use plus codes on my email addresses when I sign up for services, is there a way to search for an email address and all associated plus codes? Last I checked I couldn’t find that functionality.

jsheard 1y ago
If you use a custom domain, in the dashboard you can claim the whole domain and then see every breach for every address under it. Otherwise I don't think so.

Buttons840 1y ago

A lot of companies I've never heard of before are leaking my data. :( Can we make it so that companies I've never heard of before don't have my data in the first place?

lovich 1y ago
My latest one was from these guys https://www.eye4fraud.com/ https://www.eye4fraud.com/ who I have never knowingly done business with. Almost too absurd to be true
immibis 1y ago
[flagged]

diggan 1y ago

Who has the record for being in the most breaches? My main email seems to currently be in 40 breaches, earliest one in from June 2011 (HackForums, don't even remember what that is), and last one in September 2024 (FrenchCitizens, although I'm not French nor have I ever lived in France).

montag 1y ago
You’ve got me beat by 1. Congratulations
- coolcase 1y ago
  [flagged]
mtmail 1y ago
john@yahoo.com is in 322 breaches.
- aaronharnly 1y ago
  This is fun. john@hotmail.com has 340!
  - bazmattaz 1y ago
    John@gmail.com has 395!
    - MyPasswordSucks 1y ago
      John really needs to get his shit together.
edm0nd 1y ago
HackForums is a popular skid forum ran by an FBI informant who lives in Vegas
Brajeshwar 1y ago

YPPH 1y ago

For those who would prefer to stay a little more under the radar, you can hide results from a search of your email appearing on this service. https://haveibeenpwned.com/OptOut https://haveibeenpwned.com/OptOut

cypherpunks01 1y ago
Thanks for the info! For anyone considering, here are the 3 opt-outions that appear after you email verify: 1. Just remove my email address from public search No one using the public HIBP search feature will be able to see your email address in the results. You’ll still be able to search your own address through the notification service, which verifies that you control the email before showing any results. If your email is part of a domain monitored by someone else (e.g., your employer), the domain controller will still be able to see it in domain-level searches. 2. Remove my email address from public search and delete the list of breaches it appears in Your email address is no longer searchable — neither through the public service nor by you, even if you verify ownership — because the associated breaches have been deleted from the database. However, your email address is still retained by HIBP to ensure it is excluded from any future breaches and not added to your record. 3. Delete my email address completely The record containing your email address will be completely deleted, meaning it will no longer appear in search results — for you or the public — at the time of deletion. However, if your email address appears in future data breaches, it will become publicly searchable again, as the opt-out record itself has also been deleted.
coolcase 1y ago
What if the opt out list gets pwned?
- eddythompson80 1y ago
  I assume if that ever happens, someone will register https://haveibeenpwnedbyhaveibeenpwned.com https://haveibeenpwnedbyhaveibeenpwned.com. It'll be the top post of HN for a couple of says while everyone argues in the comments about how the state of online security is "fundamentally broken" while someone asks if they can sue. Then we'll all forget and move on.

h1fra 1y ago

nit: timeline should be most recent to least recent

rtrgrd 1y ago

Am I the only one who is experiencing severe lag when scrolling on the new site (Firefox android)?

GreenWatermelon 1y ago
Same here. Also Firefox Android.

havingapoo 1y ago

[flagged]

jmward01 1y ago

This is a great site. Thanks for making it! I wish governments would take this kind of thing seriously though. Identity theft/stealing accounts/etc etc all starts with breaches like this and in the modern world it is often less devastating to have someone break into your house than to break into your digital life. With a break in you will get actual support in the form of a phone number to call (911 in the US) and real people doing real work to track down who did it and stop them. With the digital world you have nobody to call and even if you did I doubt much followup would happen. Society needs to change gears on this stuff and actually take it seriously.

nikcub 1y ago

Lots of regular people use Have I Been Pwned and sending them to 1Password is probably the single best thing you could do for them (I know it's a sponsorship - but it's a very complimentary one). I'd make the language around that promo banner stronger (ie. "We strongly recommend") and make it stand out more on the page. So many social media accounts get hacked[0] because of shared passwords and those affected users often end up on the site - funnelling them to a password manager and a reason why it's good hygiene is great. ps. congrats on the relaunch! [0] I've probably assisted 20+ such cases in the past ~12 months

bloqs 1y ago
Why not bitwarden?
tallanvor 1y ago
It's a sponsorship, so I'm not complaining, but if the goal was really to get people to use a password manager he would be sending them to Bitwarden since they have a free plan, plus their paid plan is only $10/year compared to $36 for 1Password.
- diggan 1y ago
  Besides the pricing, is there any reason to prefer Bitwarden over 1Password? Been happily using 1Password for some years, never had any issues, but maybe I'm glossing over anything? Probably the cli interface (`op`) is the one feature I couldn't live without today.
  - MattSteelblade 1y ago
    Open-source versus proprietary and the option to self-host are the two that immediately come to mind.
    - atonse 1y ago
      I can't speak about the other password managers, but 1Password's architecture ensures even 1Password can't see any of your credentials. It's E2E Encrypted. I've been a 1Password user for over a decade. It's user friendly, and I'd rather not have the responsibility to self-host my company and extended family's credentials.

bix6 1y ago

Awesome! My timeline is showing out of order though (starts with a 2013 then a 2019 then a 2011).

glandium 1y ago

There's something interesting in the domain search: some breaches contain addresses that... simply don't exist. Like B2BUSABusinesses has sales@mydomain.

luchris429 1y ago

I love this site! Though I do wonder how much this site also helps amateur hackers find where to search for a specific person's password. One way to deal with it could be to email the person their pwns.

edm0nd 1y ago
As a security researcher who is into OSINT, HIBP is my first go to when obtaining an email address of interest. If it's found, it immediately helps me know which leaked DBs to go grep through and find more info about the target email addy. Obtaining and storing TBs of leaked databases is another part of the puzzle that is always growing and a bit more complex.

deleted 1y ago

[deleted]

johnklos 1y ago

I really wish Troy would've put a little more thought in to this before deciding to host using a for-profit corporation based in the US that wants to be a monopoly. Will Cloudflare sell data to US TLA agencies? Probably.

hanatanaka1984 1y ago

Great service. I use regularly with extended family to convince use of MFA.

lynnharry 1y ago
In our country, email has never been widely adopted among non-tech-savvy citizens. SMS verification remains the most popular—and likely safer—method.

Saris 1y ago

I really wish I could put in my domain name, I have so many aliases that it's basically impossible to search each one individually.

flas9sd 1y ago
it's right there after the "The Domain Search Feature" heading. Verify ownership, then you get results
- Saris 1y ago
  Ahh I see it on the footer of the website, a bit hidden! I'm not sure I really need it for personal use, more just a cool thing to see, so I'm a bit undecided on paying for the domain feature. I can see it being useful for a business though where each email is a different employee dealing with accounts everywhere.
  - aaronharnly 1y ago
    You can pay for just one month at a time. I pay now and then and check in on my personal domain – like you, I use dozens of email addresses with a catchall.
    - ohhnoodont 1y ago
      The first tier ($4/month) only works for up to 25 aliases. Depending on how many of your aliases have leaked, you may have to pay a lot to perform that check. I wish HIBP had a solution for those of us who are individuals but use domain catchall forwarding as our method for separating accounts. It feels good to see adobe@mydomain.com, newrelic@mydomain.com, internetarchive@mydomain.com, etc. there but not any of the addresses I use for normal communication.
      - cbull 1y ago
        Agree completely. I got ownership of my domain before he started charging, but looking now there's only a summary and it lists 45 email addresses in breaches, which means I need to pay a substantial amount to get a report, and I'm the only user of the domain for email. I wish there was a "I'm just one person, or a small family" tier for this.

geor9e 1y ago

The input box doesn't work

BubbleRings 1y ago

I’ve never been able to figure out how haveibeenpwned.com can be useful to me, since I have had the same email address for many years and I don’t want to give it up. Do people get a new primary email address every time their address shows up in a breach list like haveibeenpwned ?

MarioMan 1y ago
It's more than just the email. If you're in the breach, it might now publicly tie your email to things like your real name. You also have to worry if you reuse passwords (which you shouldn't do even if you haven't been in a breach), because now the password in the breach is known to be used with that email address, and attackers will pivot to other services to try those same credentials elsewhere.
gerdesj 1y ago
Your identity isn't a problem! Its the password bit.
- akimbostrawman 1y ago
  Until it is https://en.wikipedia.org/wiki/Ashley_Madison_data_breach https://en.wikipedia.org/wiki/Ashley_Madison_data_breach Using different random email aliases for each service is as much best practice as is different random passwords.
salomonk_mur 1y ago
They change their passwords...
paranoidrobot 1y ago
For personal use: To know what services you use have been breached. You can then follow it up with ensuring you rotate the password on that site/service. If they have other PII of yours, it's a heads up that scammers might target you and/or your family with that information. For work use: To monitor which sites/services employees use with work email addresses, and use it as a reminder/re-enforcement that they should rotate credentials used on that service, and if they're reusing them at work - to change there, too.

msephton 1y ago

Interestingly, the timeline is not chronological for me? I can't seem to figure it out the order it is in.

curtisszmania 1y ago

[dead]

willmarquis 1y ago

Really impressive evolution of a crucial service. The architectural and UX improvements are well thought out, especially the focus on resilience and scalability. Love the transparency around the decision-making process, too-Troy’s commitment to keeping HIBP fast, free, and useful is a great example of public-interest software done right. The migration to .NET 8 and use of Cloudflare for caching shows how mature and modern the stack is becoming.

deleted 1y ago

[deleted]

benob 1y ago

Ok, one of my email addresses is in a bunch of leaks. What is interesting is that most services on this list I have never used. How did they get my email in the first place? What is the accuracy of that whole business?

WhereIsTheTruth 1y ago

It's funny how you can find someone's interests just by typing his/her email address The ultimate tracking tool

kmarc 1y ago

The ';-- in front of Pwned is a brilliant idea but less brilliant execution. Missed opportunity, I'm wondering how many people don't realize what it is

mindwok 1y ago
I definitely know what it is but for those who don’t what would you tell them
- adhamsalama 1y ago
  I think it's an SQL injection.
- florbnit 1y ago
  Relevant xkcd: https://xkcd.com/327/ https://xkcd.com/327/
flysand7 1y ago
Oh that's what it was! I actually didn't think much of it until you pointed it out. At a glance looked like some random arrangement of squares
addandsubtract 1y ago
Oh, I thought it was the loss meme.

micw 1y ago

Unfortunately the new UI does not allow to search for leaked phone numbers anymore. The old did (e.g. could check for facebook phone number leak, see https://www.troyhunt.com/the-facebook-phone-numbers-are-now-searchable-in-have-i-been-pwned/ https://www.troyhunt.com/the-facebook-phone-numbers-are-now-...). The new does not let it pass through the input field. Edit: it's also statet in the announcement: > Just one little thing first - we've dropped username and phone number search support from the website But it's really a bad time to remove this feature since there's a ongoing law suite against facebook in germany (https://www.vzbv.de/pressemitteilungen/facebook-datenleck-betroffene-koennen-sich-der-sammelklage-des-vzbv-anschliessen https://www.vzbv.de/pressemitteilungen/facebook-datenleck-be..., hgerman link) that utilized the search there to know if one can participate or not.

FinnKuhn 1y ago
The API still supports it so it should still be possible to implement a new solution for it. The reasons for dropping the feature as outlined in the announcement seem very reasonable to me considering the larger implications.

xlbuttplug2 1y ago

Now waiting for this website to get pwned for its search history so hackers can identify targets worth pursuing.

yieldcrv 1y ago

Too bad the term pwned dates us now I think we’re backed to hacked

stevekemp 1y ago

Like many people I have a "main" email address, and I use per-company addresses for almost everything else. Now that the domain-searches require subscriptions this site has become much less useful. I just added my domain to the site again and I see "2,243 Total Breached Addresses", and "18 Addresses excluding Spam Lists", but I have no idea what they are. Attempting to click the links shows me I need to "upgrade" to see them, and the download of excel and JSON result in 404 errors. Too bad, I guess if you have only a single email address it might be good to get informed, but if you use a domain with multiple addresses it's way less useful.

flurdy 1y ago
I have quite a few personal catch-all domain names, and two of the main ones are used for the per website alias as you do, so over a decade and longer later, I would never be able to manually enter each address. Or remember them. And yes, the subscribe restrictions for domain searches are annoying. But Troy and family also need to eat, so I understand the need for a payment part, especially for companies. We just ended up in the grey zone in between. I wish there were some more nuances, but then again, HIBP can't cater for every edge case unless they want to hire lots of devs and customer services. I ended up signing up for a subscription, checked my domains, and then cancelled the subscription. It felt a little cumbersome, but ok. A non-recurring 2-day access would have worked for me...
diggan 1y ago
I have a similar setup, and also use lots of addresses at one domain. But I'm not subscribed (as far as I know) and I can do a wildcard search at my domain without issues, and also see exactly what emails been leaked. I don't see what leaks they're part of, but that feels less relevant, I already know where it got leaked as each email is for one product/project/company.
tiffanyh 1y ago
Is your per-company addresses a derivation of your main email address? If so, this is called “email tumbling” and services exist to strip the “per-company” part to expose your main email.

gherkinnn 1y ago

https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords Checking the passwords, "password" has been pwned >21 million times. I don't know what I expected.

bstsb 1y ago

i like the new design, but it feels that the "stats" like the cache hit ratio and edge locations won't matter to the vast majority of visitors, who are just trying to check for potential breaches. on the other hand, they will be great for the api/business pages

Squeeeez 1y ago

Does anyone feel like paying $274 and checking if the domains search allows gmail, hotmail etc? :o)

TonyTrapp 1y ago
I signed up for domain search when it was still free. It requires verifying an email address that you shouldn't have access to, unless the email service in question is not set up according to RFCs.

BurnGpuBurn 1y ago

1) The search function has disappeared from the home page. 2) When clicking "details" on one of the search results, and then the back button, the search results disappear. 3) Other than that, thanks man great service!

randunel 1y ago

New HIBP, same old restriction banning users from 3rd world countries https://imgur.com/a/AzNSreV https://imgur.com/a/AzNSreV

Y_Y 1y ago
"Have I been pwned... at birth, by accidents of geography and economics" Sorry that's happened to you. The only remedy I can think of is get a non-commercial proxy in some "recommended" country like through a friend.
skarz 1y ago
VPN?

greatgib 1y ago

I was always frustrated by this service because it is good to tell you that you have been pwned and your email appears in a breach but sadly it is more often than not more scary than useful as you can't see exactly what has been leaked about you. Especially your password. I understand the rational to hide the details, but bad actors like criminal probably have the source file with the details anyway. What annoys me is that it is good to know that your email appears in a random pastebin agglomerating hundreds of leaks but if they don't give the exact name and date of the site, and without seeing the password it is hard to know who leaked your data and which password to change. The worse is that I was used to use a very shitty simple password for all the sites that ask one without needing one (let's say media with free subscription needed to read a single article, Free conference or online webinar), ... and these one are the best targets to have leaks despite them being totally harmless if you take care to not give your personal info inside.

robertlagrant 1y ago

I just very much appreciate a regular gaming typo having made such a cultural impact over the last 25 years.

keybored 1y ago

> The AI > I wanted to make a quick note of this here, as AI seems to be either constantly overblown or denigrated. This just gestures at middle-of-the-road thinking. So what’s this begrudging note about? To set us on the correct course in the middle of the road? > I'd say it was right 90% of the time, too, and if you're not using AI aggressively in your software development work now (and I'm sure there are much better ways, too) I'm pretty confident in saying "you're doing it wrong". Well done. AI plug done. I don’t see how that statement fulfills the implied middle-of-the-road opinion though.

Aachen 1y ago

> It's likely a single-digit percentage of requests that are real humans being [blocked], and we need to look at ways to get that number down, but at least the fallback positions are improved now. The fallback suggestions mentioned in the article are "try clicking the box again" and "try reloading the page" I'm slowly starting to wonder if I should start sending snail mail to companies that block me, instead of resigning to go somewhere else. HIBP is a free web service and shops have no obligation to serve a given individual, but it everyone puts CloudFlare Turnstile, Google Recaptcha, etc. in front of their services, a "single-digit percentage" of people simply cannot participate in modern society. Similar markers (IP address misclassified as bot range, unusual/old/infected browser, ...) will constantly be triggering for the same group

whizzter 1y ago
Agreed, it seems like my (fixed) IP address is triggering Google and CF for some reason. I don't run any scrapers or so from home but do use NoScript, am I a bot for using NoScript? Perhaps.
- jacekm 1y ago
  Yeah, I have rather aggressive blocking on with uBlock Origin. Google started blocking me about a month ago, I have to solve captcha for literally every query. I know it's uBlock as things are back to normal when I disable it. Well, this helps me to learn new muscle memory to rely on DuckDuckGo and Brave Search instead.
Aachen 1y ago
6 hours later, case in point... I'm blocked logging into Slack due to an invisible captcha: https://snipboard.io/h1E86S.jpg https://snipboard.io/h1E86S.jpg I was surprised I was failing to type this code over from my email but no, that wasn't the issue. In the developer tools, the server fesses up I'm detected as "bot" again. As it's an invisible process, there's nothing I can do about it. This is a clean browser because it's for pentesting websites at work. No add-ons installed, no uBlock, no noscript, no corporate configuration, nothing
1y ago

l72 1y ago

I use a lot of email+site@example.com. It would be great if those were included too!

santiagobasulto 1y ago

When it mentions that your password has been leaked for a service, is this the plain text pwd (that service somehow stored that way) or is it a hash? Was the website salting the passwords (so no rainbow-table attack could happen)? What key derivation function were they using? Etc... I feel the red circle with "Password compromised" is way too simplistic if this wants to be a TRUE trusty site regarding cybersecurity. If they just want to show fear and sell 1Password ads, I understand it, I won't consult it anymore. But if they want to really step up their game from a technical perspective, they should include more details.

fckgw 1y ago
Every detailed blurb on the breach that I've seen says "Passwords stored as" and lets you know how they were encrypted.
slumberlust 1y ago
I'm not convinced the target audience is infosec. I've leveraged this site a few times to show family members the pervasiveness of breaches and to recommend pw managers. If a tool like this can help a few people increase their posture then I consider it a success.

brightball 1y ago

Does it feel like this site is itself a vulnerability? It seems like being able to go type in anybody's email address and just get a list of sites where it was found would be part of an OSINT process. Shouldn't it at least send you a link to verify that you control the address before showing your results?

pixxel 1y ago
[dead]
replwoacause 1y ago
I felt the exact same way. Especially because I saw my email had been registered and leaked by some seedy looking conservative news site full of Trump propaganda. I always knew people could sign others up for junk "malicious subscriptions" and suspected that is what happened when I would get this trash in my inbox, but now seeing that other people can also see it very publicly is disturbing. How are they to know I didn't sign up for this myself? I'd hate to think people were thinking that about me. EDIT: Seems like https://haveibeenpwned.com/OptOut https://haveibeenpwned.com/OptOut does the trick.
upcoming-sesame 1y ago
I guess the assumption is that bad actors have access to the data anyway so putting such verification process is not deterring any bad actor in any way
whatamidoingyo 1y ago
This is indeed a part of an OSINT process. Always has been.
remus 1y ago
> Does it feel like this site is itself a vulnerability? It seems like being able to go type in anybody's email address and just get a list of sites where it was found would be part of an OSINT process. I think it is a reasonable trade-off. For non-technical people (i.e. ~everyone) it provides a really useful service where you can see if your data has been leaked and what passwords to reset. For bad guys it makes their lives a little easier by creating a quick lookup and potentially knowledge about some leaks they weren't aware of, but ultimately there'd be a dark web version if HIBP didn't exist. I think there's also a lot of PR value in a site like HIBP. If a non-technical person sees a headline like "400 million customer records leaked by Big Corp" it feels pretty abstract, but if you go and type your email address into HIBP and see a list of companies who have leaked your email address (and most likely some other data) it feels more personal.

giancarlostoro 1y ago

I keep wondering if its smart to just roll over an email address when it gets compromised, and limit your exposure, as well as force you to change your password while you're on every website ditching your former email. I know some people use email tags, but maybe just rolling a new email might be better, followed by deleting unused dead accounts you will never use again.

paulnpace 1y ago

I just verified that this database does not include the Vultr breach, or, at least it does not include email addresses that are unique to the Vultr service.

paulnpace 1y ago
Geez, and they have one of my domains with an address claiming to have been compromised by "B2B USA Businesses" in a leak in mid-2017, which is over a year before the domain was registered.

skarz 1y ago

What's the best service or app for tracking data breaches where your username and password are leaked? I'm trying to mitigate some leaks through ProtonPass but it's very frustrating as they simply say "password ****123 was found on the dark web" (they actually redact the full password) so then I manually have to go through my 100+ passwords and look for that particular password.

appleaday1 1y ago

Lol I was looking at recently or yesterday and was wondering why it looked more nicer and usable than usual heh.