Is it safe to give my email address to a service like haveibeenpwned in light of the publication of...












16















There is a new big case of stolen login/password data in the news. At the same time, I am reading that there are services that let you check if your own login data is affected, e.g.
Have I Been Pwned.



Is it safe to enter my email address there to find out whether I need to change my passwords?










share|improve this question









New contributor




godwana is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
















  • 17





    Yes, it is safe. haveibeenpwned.com is a well respected website run by a well respected individual. (Troy Hunt.)

    – Xander
    17 hours ago






  • 23





    Note that @Xander's comment only applies to that specific site - there are others which are also fine, but by no means all. Any site which asks you to provide the email address and password to check is best avoided (note that while HIBP does offer a password checker, it doesn't require any other data for that function)

    – Matthew
    17 hours ago






  • 4





    To be honest - can it be - has it been - independantly verified that haveibeenpwned.com is safe? I don't doubt it is, but really what I'm going on is little more than trust. Has there been any 3rd party penetration testing analysis? (open question)

    – Martin
    16 hours ago






  • 1





    @Martin Not that I know of, but even if there was a pentest or code audit a year ago, how would we know that the same code is used today? Even if the code was open source, how would we know if that was the version that was deployed? Then in theory a single request could be altered in such a way, that the data of specific users was handled differently.

    – Tom K.
    15 hours ago






  • 7





    Well to be honest, the worst what could happen @Martin is that Troy Hunt (which is a well known respected security author) has your email address. I actually have an email address to give to people so they can contact me, if that is the only PII I am giving out I'm not so worried ;)

    – Kevin Voorn
    13 hours ago
















16















There is a new big case of stolen login/password data in the news. At the same time, I am reading that there are services that let you check if your own login data is affected, e.g.
Have I Been Pwned.



Is it safe to enter my email address there to find out whether I need to change my passwords?










share|improve this question









New contributor




godwana is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.
















  • 17





    Yes, it is safe. haveibeenpwned.com is a well respected website run by a well respected individual. (Troy Hunt.)

    – Xander
    17 hours ago






  • 23





    Note that @Xander's comment only applies to that specific site - there are others which are also fine, but by no means all. Any site which asks you to provide the email address and password to check is best avoided (note that while HIBP does offer a password checker, it doesn't require any other data for that function)

    – Matthew
    17 hours ago






  • 4





    To be honest - can it be - has it been - independantly verified that haveibeenpwned.com is safe? I don't doubt it is, but really what I'm going on is little more than trust. Has there been any 3rd party penetration testing analysis? (open question)

    – Martin
    16 hours ago






  • 1





    @Martin Not that I know of, but even if there was a pentest or code audit a year ago, how would we know that the same code is used today? Even if the code was open source, how would we know if that was the version that was deployed? Then in theory a single request could be altered in such a way, that the data of specific users was handled differently.

    – Tom K.
    15 hours ago






  • 7





    Well to be honest, the worst what could happen @Martin is that Troy Hunt (which is a well known respected security author) has your email address. I actually have an email address to give to people so they can contact me, if that is the only PII I am giving out I'm not so worried ;)

    – Kevin Voorn
    13 hours ago














16












16








16


5






There is a new big case of stolen login/password data in the news. At the same time, I am reading that there are services that let you check if your own login data is affected, e.g.
Have I Been Pwned.



Is it safe to enter my email address there to find out whether I need to change my passwords?










share|improve this question









New contributor




godwana is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.












There is a new big case of stolen login/password data in the news. At the same time, I am reading that there are services that let you check if your own login data is affected, e.g.
Have I Been Pwned.



Is it safe to enter my email address there to find out whether I need to change my passwords?







passwords breach have-i-been-pwned






share|improve this question









New contributor




godwana is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.











share|improve this question









New contributor




godwana is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









share|improve this question




share|improve this question








edited 4 mins ago









Tom K.

5,70032250




5,70032250






New contributor




godwana is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.









asked 17 hours ago









godwanagodwana

8113




8113




New contributor




godwana is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.





New contributor





godwana is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.






godwana is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.








  • 17





    Yes, it is safe. haveibeenpwned.com is a well respected website run by a well respected individual. (Troy Hunt.)

    – Xander
    17 hours ago






  • 23





    Note that @Xander's comment only applies to that specific site - there are others which are also fine, but by no means all. Any site which asks you to provide the email address and password to check is best avoided (note that while HIBP does offer a password checker, it doesn't require any other data for that function)

    – Matthew
    17 hours ago






  • 4





    To be honest - can it be - has it been - independantly verified that haveibeenpwned.com is safe? I don't doubt it is, but really what I'm going on is little more than trust. Has there been any 3rd party penetration testing analysis? (open question)

    – Martin
    16 hours ago






  • 1





    @Martin Not that I know of, but even if there was a pentest or code audit a year ago, how would we know that the same code is used today? Even if the code was open source, how would we know if that was the version that was deployed? Then in theory a single request could be altered in such a way, that the data of specific users was handled differently.

    – Tom K.
    15 hours ago






  • 7





    Well to be honest, the worst what could happen @Martin is that Troy Hunt (which is a well known respected security author) has your email address. I actually have an email address to give to people so they can contact me, if that is the only PII I am giving out I'm not so worried ;)

    – Kevin Voorn
    13 hours ago














  • 17





    Yes, it is safe. haveibeenpwned.com is a well respected website run by a well respected individual. (Troy Hunt.)

    – Xander
    17 hours ago






  • 23





    Note that @Xander's comment only applies to that specific site - there are others which are also fine, but by no means all. Any site which asks you to provide the email address and password to check is best avoided (note that while HIBP does offer a password checker, it doesn't require any other data for that function)

    – Matthew
    17 hours ago






  • 4





    To be honest - can it be - has it been - independantly verified that haveibeenpwned.com is safe? I don't doubt it is, but really what I'm going on is little more than trust. Has there been any 3rd party penetration testing analysis? (open question)

    – Martin
    16 hours ago






  • 1





    @Martin Not that I know of, but even if there was a pentest or code audit a year ago, how would we know that the same code is used today? Even if the code was open source, how would we know if that was the version that was deployed? Then in theory a single request could be altered in such a way, that the data of specific users was handled differently.

    – Tom K.
    15 hours ago






  • 7





    Well to be honest, the worst what could happen @Martin is that Troy Hunt (which is a well known respected security author) has your email address. I actually have an email address to give to people so they can contact me, if that is the only PII I am giving out I'm not so worried ;)

    – Kevin Voorn
    13 hours ago








17




17





Yes, it is safe. haveibeenpwned.com is a well respected website run by a well respected individual. (Troy Hunt.)

– Xander
17 hours ago





Yes, it is safe. haveibeenpwned.com is a well respected website run by a well respected individual. (Troy Hunt.)

– Xander
17 hours ago




23




23





Note that @Xander's comment only applies to that specific site - there are others which are also fine, but by no means all. Any site which asks you to provide the email address and password to check is best avoided (note that while HIBP does offer a password checker, it doesn't require any other data for that function)

– Matthew
17 hours ago





Note that @Xander's comment only applies to that specific site - there are others which are also fine, but by no means all. Any site which asks you to provide the email address and password to check is best avoided (note that while HIBP does offer a password checker, it doesn't require any other data for that function)

– Matthew
17 hours ago




4




4





To be honest - can it be - has it been - independantly verified that haveibeenpwned.com is safe? I don't doubt it is, but really what I'm going on is little more than trust. Has there been any 3rd party penetration testing analysis? (open question)

– Martin
16 hours ago





To be honest - can it be - has it been - independantly verified that haveibeenpwned.com is safe? I don't doubt it is, but really what I'm going on is little more than trust. Has there been any 3rd party penetration testing analysis? (open question)

– Martin
16 hours ago




1




1





@Martin Not that I know of, but even if there was a pentest or code audit a year ago, how would we know that the same code is used today? Even if the code was open source, how would we know if that was the version that was deployed? Then in theory a single request could be altered in such a way, that the data of specific users was handled differently.

– Tom K.
15 hours ago





@Martin Not that I know of, but even if there was a pentest or code audit a year ago, how would we know that the same code is used today? Even if the code was open source, how would we know if that was the version that was deployed? Then in theory a single request could be altered in such a way, that the data of specific users was handled differently.

– Tom K.
15 hours ago




7




7





Well to be honest, the worst what could happen @Martin is that Troy Hunt (which is a well known respected security author) has your email address. I actually have an email address to give to people so they can contact me, if that is the only PII I am giving out I'm not so worried ;)

– Kevin Voorn
13 hours ago





Well to be honest, the worst what could happen @Martin is that Troy Hunt (which is a well known respected security author) has your email address. I actually have an email address to give to people so they can contact me, if that is the only PII I am giving out I'm not so worried ;)

– Kevin Voorn
13 hours ago










2 Answers
2






active

oldest

votes


















28














This question was explained by Troy Hunt several times on his blog, on Twitter and in the FAQ of haveibeenpwned.com



See here:




When you search for an email address



Searching for an email address only ever retrieves the address from storage then returns it in the response, the searched address is never explicitly stored anywhere. See the Logging section below for situations in which it may be implicitly stored.



Data breaches flagged as sensitive are not returned in public searches, they can only be viewed by using the notification service and verifying ownership of the email address first. Sensitive breaches are also searchable by domain owners who prove they control the domain using the domain search feature. Read about why non-sensitive breaches are publicly searchable.




See also the Logging paragraph



And from the FAQ:




How do I know the site isn't just harvesting searched email addresses?



You don't, but it's not. The site is simply intended to be a free service for people to assess risk in relation to their account being caught up in a breach. As with any website, if you're concerned about the intent or security, don't use it.




Of course we have to trust Troy Hunt on his claims, as we have no way of proving that he is not doing something else, when handling your specific request.

But I think it is more than fair to say, that haveibeenpwned is a valuable service and Troy Hunt himself is a respected member of the infosec community.



But let's suppose we don't trust Troy: what do you have to loose? You might disclose your email address to him. How big of a risk is that to you, when you can just enter any email address you want?

At the end of the day, HIBP is a free service for you(!) that costs Troy Hunt money. You can choose to search through all the password databses of the world yourself, if you don't want to take the risk, that maybe a lot of people are wrong about Troy Hunt - because then you would disclose your email address.






share|improve this answer





















  • 23





    As mentioned before: this only applies to haveibeenpwned.com. Other services might be sketchy and sell your data off to spam providers.

    – Tom K.
    16 hours ago






  • 3





    HIBP is a free service for you(!) that costs Troy Hunt money I find this detracts from your answer as such services usually find a way to make money from the data you send them (e.g. targeted advertising). It doesn't answer the "is it safe" question anyway.

    – Aaron
    14 hours ago








  • 1





    Well, a lot of times there are pros and cons to a side. ;) I won't delete it, because other sites offer free services to then sell off your personal data. To infer that HIBP does the same without any proof seems very odd to me.

    – Tom K.
    13 hours ago






  • 1





    @SSight3 It's worth noting, that this has already been noted in my answer. ;)

    – Tom K.
    13 hours ago






  • 2





    Besides only applying to haveibeenpwned.com, this answer only applies to haveibeenpwned.com as of the time this answer was posted. A necessary caveat to any endorsement is that a service isn't guaranteed to be trustworthy for the remainder of its lifetime. A server can be hacked, a policy can be changed, a buyout can happen, a domain name can be seized, or a trustworthy guy could stumble into his supervillain origin story.

    – Future Security
    10 hours ago



















6














Troy Hunt is a very respected Information Security professional and this service is being used by millions of people worldwide, even by some password managers to verify if the passwords selected by the users have been involved in a data breach.



See for example, https://1password.com/haveibeenpwned/



As per the website, 1Password integrates with the popular site Have I Been Pwned to keep an eye on your logins for any potential security breaches or vulnerabilities.



Entering your email address on this site will tell you which data breaches involve this email address, so that you can go back to the affected website and change your password. This is esp. important if you have used the same password for multiple websites, where credentials stolen from one site can be used to attack other sites in a technique also called Credential Stuffing attack.




The following StackExchange post has a response from Troy himself with
further clarification on this service:
Is "Have I Been Pwned's" Pwned Passwords List really that useful?







share|improve this answer





















  • 1





    The linked question and answer by Hunt specifically deals with the "Pwned Password" feature.

    – Tom K.
    10 hours ago











Your Answer








StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "162"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
noCode: true, onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});


}
});






godwana is a new contributor. Be nice, and check out our Code of Conduct.










draft saved

draft discarded


















StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f201654%2fis-it-safe-to-give-my-email-address-to-a-service-like-haveibeenpwned-in-light-of%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown

























2 Answers
2






active

oldest

votes








2 Answers
2






active

oldest

votes









active

oldest

votes






active

oldest

votes









28














This question was explained by Troy Hunt several times on his blog, on Twitter and in the FAQ of haveibeenpwned.com



See here:




When you search for an email address



Searching for an email address only ever retrieves the address from storage then returns it in the response, the searched address is never explicitly stored anywhere. See the Logging section below for situations in which it may be implicitly stored.



Data breaches flagged as sensitive are not returned in public searches, they can only be viewed by using the notification service and verifying ownership of the email address first. Sensitive breaches are also searchable by domain owners who prove they control the domain using the domain search feature. Read about why non-sensitive breaches are publicly searchable.




See also the Logging paragraph



And from the FAQ:




How do I know the site isn't just harvesting searched email addresses?



You don't, but it's not. The site is simply intended to be a free service for people to assess risk in relation to their account being caught up in a breach. As with any website, if you're concerned about the intent or security, don't use it.




Of course we have to trust Troy Hunt on his claims, as we have no way of proving that he is not doing something else, when handling your specific request.

But I think it is more than fair to say, that haveibeenpwned is a valuable service and Troy Hunt himself is a respected member of the infosec community.



But let's suppose we don't trust Troy: what do you have to loose? You might disclose your email address to him. How big of a risk is that to you, when you can just enter any email address you want?

At the end of the day, HIBP is a free service for you(!) that costs Troy Hunt money. You can choose to search through all the password databses of the world yourself, if you don't want to take the risk, that maybe a lot of people are wrong about Troy Hunt - because then you would disclose your email address.






share|improve this answer





















  • 23





    As mentioned before: this only applies to haveibeenpwned.com. Other services might be sketchy and sell your data off to spam providers.

    – Tom K.
    16 hours ago






  • 3





    HIBP is a free service for you(!) that costs Troy Hunt money I find this detracts from your answer as such services usually find a way to make money from the data you send them (e.g. targeted advertising). It doesn't answer the "is it safe" question anyway.

    – Aaron
    14 hours ago








  • 1





    Well, a lot of times there are pros and cons to a side. ;) I won't delete it, because other sites offer free services to then sell off your personal data. To infer that HIBP does the same without any proof seems very odd to me.

    – Tom K.
    13 hours ago






  • 1





    @SSight3 It's worth noting, that this has already been noted in my answer. ;)

    – Tom K.
    13 hours ago






  • 2





    Besides only applying to haveibeenpwned.com, this answer only applies to haveibeenpwned.com as of the time this answer was posted. A necessary caveat to any endorsement is that a service isn't guaranteed to be trustworthy for the remainder of its lifetime. A server can be hacked, a policy can be changed, a buyout can happen, a domain name can be seized, or a trustworthy guy could stumble into his supervillain origin story.

    – Future Security
    10 hours ago
















28














This question was explained by Troy Hunt several times on his blog, on Twitter and in the FAQ of haveibeenpwned.com



See here:




When you search for an email address



Searching for an email address only ever retrieves the address from storage then returns it in the response, the searched address is never explicitly stored anywhere. See the Logging section below for situations in which it may be implicitly stored.



Data breaches flagged as sensitive are not returned in public searches, they can only be viewed by using the notification service and verifying ownership of the email address first. Sensitive breaches are also searchable by domain owners who prove they control the domain using the domain search feature. Read about why non-sensitive breaches are publicly searchable.




See also the Logging paragraph



And from the FAQ:




How do I know the site isn't just harvesting searched email addresses?



You don't, but it's not. The site is simply intended to be a free service for people to assess risk in relation to their account being caught up in a breach. As with any website, if you're concerned about the intent or security, don't use it.




Of course we have to trust Troy Hunt on his claims, as we have no way of proving that he is not doing something else, when handling your specific request.

But I think it is more than fair to say, that haveibeenpwned is a valuable service and Troy Hunt himself is a respected member of the infosec community.



But let's suppose we don't trust Troy: what do you have to loose? You might disclose your email address to him. How big of a risk is that to you, when you can just enter any email address you want?

At the end of the day, HIBP is a free service for you(!) that costs Troy Hunt money. You can choose to search through all the password databses of the world yourself, if you don't want to take the risk, that maybe a lot of people are wrong about Troy Hunt - because then you would disclose your email address.






share|improve this answer





















  • 23





    As mentioned before: this only applies to haveibeenpwned.com. Other services might be sketchy and sell your data off to spam providers.

    – Tom K.
    16 hours ago






  • 3





    HIBP is a free service for you(!) that costs Troy Hunt money I find this detracts from your answer as such services usually find a way to make money from the data you send them (e.g. targeted advertising). It doesn't answer the "is it safe" question anyway.

    – Aaron
    14 hours ago








  • 1





    Well, a lot of times there are pros and cons to a side. ;) I won't delete it, because other sites offer free services to then sell off your personal data. To infer that HIBP does the same without any proof seems very odd to me.

    – Tom K.
    13 hours ago






  • 1





    @SSight3 It's worth noting, that this has already been noted in my answer. ;)

    – Tom K.
    13 hours ago






  • 2





    Besides only applying to haveibeenpwned.com, this answer only applies to haveibeenpwned.com as of the time this answer was posted. A necessary caveat to any endorsement is that a service isn't guaranteed to be trustworthy for the remainder of its lifetime. A server can be hacked, a policy can be changed, a buyout can happen, a domain name can be seized, or a trustworthy guy could stumble into his supervillain origin story.

    – Future Security
    10 hours ago














28












28








28







This question was explained by Troy Hunt several times on his blog, on Twitter and in the FAQ of haveibeenpwned.com



See here:




When you search for an email address



Searching for an email address only ever retrieves the address from storage then returns it in the response, the searched address is never explicitly stored anywhere. See the Logging section below for situations in which it may be implicitly stored.



Data breaches flagged as sensitive are not returned in public searches, they can only be viewed by using the notification service and verifying ownership of the email address first. Sensitive breaches are also searchable by domain owners who prove they control the domain using the domain search feature. Read about why non-sensitive breaches are publicly searchable.




See also the Logging paragraph



And from the FAQ:




How do I know the site isn't just harvesting searched email addresses?



You don't, but it's not. The site is simply intended to be a free service for people to assess risk in relation to their account being caught up in a breach. As with any website, if you're concerned about the intent or security, don't use it.




Of course we have to trust Troy Hunt on his claims, as we have no way of proving that he is not doing something else, when handling your specific request.

But I think it is more than fair to say, that haveibeenpwned is a valuable service and Troy Hunt himself is a respected member of the infosec community.



But let's suppose we don't trust Troy: what do you have to loose? You might disclose your email address to him. How big of a risk is that to you, when you can just enter any email address you want?

At the end of the day, HIBP is a free service for you(!) that costs Troy Hunt money. You can choose to search through all the password databses of the world yourself, if you don't want to take the risk, that maybe a lot of people are wrong about Troy Hunt - because then you would disclose your email address.






share|improve this answer















This question was explained by Troy Hunt several times on his blog, on Twitter and in the FAQ of haveibeenpwned.com



See here:




When you search for an email address



Searching for an email address only ever retrieves the address from storage then returns it in the response, the searched address is never explicitly stored anywhere. See the Logging section below for situations in which it may be implicitly stored.



Data breaches flagged as sensitive are not returned in public searches, they can only be viewed by using the notification service and verifying ownership of the email address first. Sensitive breaches are also searchable by domain owners who prove they control the domain using the domain search feature. Read about why non-sensitive breaches are publicly searchable.




See also the Logging paragraph



And from the FAQ:




How do I know the site isn't just harvesting searched email addresses?



You don't, but it's not. The site is simply intended to be a free service for people to assess risk in relation to their account being caught up in a breach. As with any website, if you're concerned about the intent or security, don't use it.




Of course we have to trust Troy Hunt on his claims, as we have no way of proving that he is not doing something else, when handling your specific request.

But I think it is more than fair to say, that haveibeenpwned is a valuable service and Troy Hunt himself is a respected member of the infosec community.



But let's suppose we don't trust Troy: what do you have to loose? You might disclose your email address to him. How big of a risk is that to you, when you can just enter any email address you want?

At the end of the day, HIBP is a free service for you(!) that costs Troy Hunt money. You can choose to search through all the password databses of the world yourself, if you don't want to take the risk, that maybe a lot of people are wrong about Troy Hunt - because then you would disclose your email address.







share|improve this answer














share|improve this answer



share|improve this answer








edited 9 hours ago









Captain Man

1134




1134










answered 16 hours ago









Tom K.Tom K.

5,70032250




5,70032250








  • 23





    As mentioned before: this only applies to haveibeenpwned.com. Other services might be sketchy and sell your data off to spam providers.

    – Tom K.
    16 hours ago






  • 3





    HIBP is a free service for you(!) that costs Troy Hunt money I find this detracts from your answer as such services usually find a way to make money from the data you send them (e.g. targeted advertising). It doesn't answer the "is it safe" question anyway.

    – Aaron
    14 hours ago








  • 1





    Well, a lot of times there are pros and cons to a side. ;) I won't delete it, because other sites offer free services to then sell off your personal data. To infer that HIBP does the same without any proof seems very odd to me.

    – Tom K.
    13 hours ago






  • 1





    @SSight3 It's worth noting, that this has already been noted in my answer. ;)

    – Tom K.
    13 hours ago






  • 2





    Besides only applying to haveibeenpwned.com, this answer only applies to haveibeenpwned.com as of the time this answer was posted. A necessary caveat to any endorsement is that a service isn't guaranteed to be trustworthy for the remainder of its lifetime. A server can be hacked, a policy can be changed, a buyout can happen, a domain name can be seized, or a trustworthy guy could stumble into his supervillain origin story.

    – Future Security
    10 hours ago














  • 23





    As mentioned before: this only applies to haveibeenpwned.com. Other services might be sketchy and sell your data off to spam providers.

    – Tom K.
    16 hours ago






  • 3





    HIBP is a free service for you(!) that costs Troy Hunt money I find this detracts from your answer as such services usually find a way to make money from the data you send them (e.g. targeted advertising). It doesn't answer the "is it safe" question anyway.

    – Aaron
    14 hours ago








  • 1





    Well, a lot of times there are pros and cons to a side. ;) I won't delete it, because other sites offer free services to then sell off your personal data. To infer that HIBP does the same without any proof seems very odd to me.

    – Tom K.
    13 hours ago






  • 1





    @SSight3 It's worth noting, that this has already been noted in my answer. ;)

    – Tom K.
    13 hours ago






  • 2





    Besides only applying to haveibeenpwned.com, this answer only applies to haveibeenpwned.com as of the time this answer was posted. A necessary caveat to any endorsement is that a service isn't guaranteed to be trustworthy for the remainder of its lifetime. A server can be hacked, a policy can be changed, a buyout can happen, a domain name can be seized, or a trustworthy guy could stumble into his supervillain origin story.

    – Future Security
    10 hours ago








23




23





As mentioned before: this only applies to haveibeenpwned.com. Other services might be sketchy and sell your data off to spam providers.

– Tom K.
16 hours ago





As mentioned before: this only applies to haveibeenpwned.com. Other services might be sketchy and sell your data off to spam providers.

– Tom K.
16 hours ago




3




3





HIBP is a free service for you(!) that costs Troy Hunt money I find this detracts from your answer as such services usually find a way to make money from the data you send them (e.g. targeted advertising). It doesn't answer the "is it safe" question anyway.

– Aaron
14 hours ago







HIBP is a free service for you(!) that costs Troy Hunt money I find this detracts from your answer as such services usually find a way to make money from the data you send them (e.g. targeted advertising). It doesn't answer the "is it safe" question anyway.

– Aaron
14 hours ago






1




1





Well, a lot of times there are pros and cons to a side. ;) I won't delete it, because other sites offer free services to then sell off your personal data. To infer that HIBP does the same without any proof seems very odd to me.

– Tom K.
13 hours ago





Well, a lot of times there are pros and cons to a side. ;) I won't delete it, because other sites offer free services to then sell off your personal data. To infer that HIBP does the same without any proof seems very odd to me.

– Tom K.
13 hours ago




1




1





@SSight3 It's worth noting, that this has already been noted in my answer. ;)

– Tom K.
13 hours ago





@SSight3 It's worth noting, that this has already been noted in my answer. ;)

– Tom K.
13 hours ago




2




2





Besides only applying to haveibeenpwned.com, this answer only applies to haveibeenpwned.com as of the time this answer was posted. A necessary caveat to any endorsement is that a service isn't guaranteed to be trustworthy for the remainder of its lifetime. A server can be hacked, a policy can be changed, a buyout can happen, a domain name can be seized, or a trustworthy guy could stumble into his supervillain origin story.

– Future Security
10 hours ago





Besides only applying to haveibeenpwned.com, this answer only applies to haveibeenpwned.com as of the time this answer was posted. A necessary caveat to any endorsement is that a service isn't guaranteed to be trustworthy for the remainder of its lifetime. A server can be hacked, a policy can be changed, a buyout can happen, a domain name can be seized, or a trustworthy guy could stumble into his supervillain origin story.

– Future Security
10 hours ago













6














Troy Hunt is a very respected Information Security professional and this service is being used by millions of people worldwide, even by some password managers to verify if the passwords selected by the users have been involved in a data breach.



See for example, https://1password.com/haveibeenpwned/



As per the website, 1Password integrates with the popular site Have I Been Pwned to keep an eye on your logins for any potential security breaches or vulnerabilities.



Entering your email address on this site will tell you which data breaches involve this email address, so that you can go back to the affected website and change your password. This is esp. important if you have used the same password for multiple websites, where credentials stolen from one site can be used to attack other sites in a technique also called Credential Stuffing attack.




The following StackExchange post has a response from Troy himself with
further clarification on this service:
Is "Have I Been Pwned's" Pwned Passwords List really that useful?







share|improve this answer





















  • 1





    The linked question and answer by Hunt specifically deals with the "Pwned Password" feature.

    – Tom K.
    10 hours ago
















6














Troy Hunt is a very respected Information Security professional and this service is being used by millions of people worldwide, even by some password managers to verify if the passwords selected by the users have been involved in a data breach.



See for example, https://1password.com/haveibeenpwned/



As per the website, 1Password integrates with the popular site Have I Been Pwned to keep an eye on your logins for any potential security breaches or vulnerabilities.



Entering your email address on this site will tell you which data breaches involve this email address, so that you can go back to the affected website and change your password. This is esp. important if you have used the same password for multiple websites, where credentials stolen from one site can be used to attack other sites in a technique also called Credential Stuffing attack.




The following StackExchange post has a response from Troy himself with
further clarification on this service:
Is "Have I Been Pwned's" Pwned Passwords List really that useful?







share|improve this answer





















  • 1





    The linked question and answer by Hunt specifically deals with the "Pwned Password" feature.

    – Tom K.
    10 hours ago














6












6








6







Troy Hunt is a very respected Information Security professional and this service is being used by millions of people worldwide, even by some password managers to verify if the passwords selected by the users have been involved in a data breach.



See for example, https://1password.com/haveibeenpwned/



As per the website, 1Password integrates with the popular site Have I Been Pwned to keep an eye on your logins for any potential security breaches or vulnerabilities.



Entering your email address on this site will tell you which data breaches involve this email address, so that you can go back to the affected website and change your password. This is esp. important if you have used the same password for multiple websites, where credentials stolen from one site can be used to attack other sites in a technique also called Credential Stuffing attack.




The following StackExchange post has a response from Troy himself with
further clarification on this service:
Is "Have I Been Pwned's" Pwned Passwords List really that useful?







share|improve this answer















Troy Hunt is a very respected Information Security professional and this service is being used by millions of people worldwide, even by some password managers to verify if the passwords selected by the users have been involved in a data breach.



See for example, https://1password.com/haveibeenpwned/



As per the website, 1Password integrates with the popular site Have I Been Pwned to keep an eye on your logins for any potential security breaches or vulnerabilities.



Entering your email address on this site will tell you which data breaches involve this email address, so that you can go back to the affected website and change your password. This is esp. important if you have used the same password for multiple websites, where credentials stolen from one site can be used to attack other sites in a technique also called Credential Stuffing attack.




The following StackExchange post has a response from Troy himself with
further clarification on this service:
Is "Have I Been Pwned's" Pwned Passwords List really that useful?








share|improve this answer














share|improve this answer



share|improve this answer








edited 14 hours ago

























answered 15 hours ago









VishalVishal

715




715








  • 1





    The linked question and answer by Hunt specifically deals with the "Pwned Password" feature.

    – Tom K.
    10 hours ago














  • 1





    The linked question and answer by Hunt specifically deals with the "Pwned Password" feature.

    – Tom K.
    10 hours ago








1




1





The linked question and answer by Hunt specifically deals with the "Pwned Password" feature.

– Tom K.
10 hours ago





The linked question and answer by Hunt specifically deals with the "Pwned Password" feature.

– Tom K.
10 hours ago










godwana is a new contributor. Be nice, and check out our Code of Conduct.










draft saved

draft discarded


















godwana is a new contributor. Be nice, and check out our Code of Conduct.













godwana is a new contributor. Be nice, and check out our Code of Conduct.












godwana is a new contributor. Be nice, and check out our Code of Conduct.
















Thanks for contributing an answer to Information Security Stack Exchange!


  • Please be sure to answer the question. Provide details and share your research!

But avoid



  • Asking for help, clarification, or responding to other answers.

  • Making statements based on opinion; back them up with references or personal experience.


To learn more, see our tips on writing great answers.




draft saved


draft discarded














StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsecurity.stackexchange.com%2fquestions%2f201654%2fis-it-safe-to-give-my-email-address-to-a-service-like-haveibeenpwned-in-light-of%23new-answer', 'question_page');
}
);

Post as a guest















Required, but never shown





















































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown

































Required, but never shown














Required, but never shown












Required, but never shown







Required, but never shown







Popular posts from this blog

Knooppunt Holsloot

Altaar (religie)

Gregoriusmis