He loaded them into this site to check: https://haveibeenpwned.com/

I'm not sure troy shares the lists - for obvious reasons.

It wouldn't be a hack if it wasn't available. I can run through the hashes. I just want the list without having to jump through a bunch of hoops and pay someone to get it.

His site is basically one big advertisement for 1password now. I would not trust it.

What do you distrust?

Do you believe he's lying about the existence of certain breaches? Returning false results for whether a password is compromised? Be specific: what untrustworthy things do you suspect him of?

Since his website is now an advertisement, it's wise to take everything he says with skepticism.. is he pushing the product, or is he providing good advice? What's his motivation for helping users when his main focus is on pushing ads?

As others have pointed out in response to me, he's incredibly dishonest in claiming that his website is funded by him on one page, but clearly he's being paid by a company selling something. He injects ads into email notifications without identifying them as such.

If someone is acting untrustworthy 50% of the time, would you still trust them 100% of the time?

So, what untrustworthy things do you suspect him of?

FUD is not useful.

I'm not sure why you're being downvoted when you're exactly right. I have lost a lot of respect for Troy Hunt when he pretty much turned his blog and HIBP into a native advertisement for 1Password; without any disclosure that he is being paid by 1Password.

I'm looking at: https://haveibeenpwned.com/

I see a link below the search box, which when I click explains he has "partnered" with 1Password, why, and why he liked it prior to the partnership. It also links to this:

https://www.troyhunt.com/have-i-been-pwned-is-now-partnering...

which has a lot more detail.

That's not what I call "without any disclosure". And makes me wonder what your idea of "disclosure" would be.

"Without any disclosure" is clearly false, but it would be nice if the About page didn't still say "[s]hort of the odd donation, all costs for building, running and keeping the service currently come directly out of my own pocket."

Personally, I don't like that it starts with the reasons to not take money ("I've had many offers to sponsor HIBP, to monetarily reward me for product placement and indeed to buy the service outright. I've rejected every single one of them because I didn't want my motives to be questioned"), then it is a _long_ time before he explicitly says he is taking money ("Clearly, this is a commercial relationship - 1Password pays to get their product in front of people via HIBP").

If you received one of the breach emails, there is a 1Password ad in the middle with no obvious disclosure that it's an ad / affiliate link.

https://i.imgur.com/g5btx15.png

Worth noting that the same emails also solicit donations, and there is no disclosure on the donations page:

> If you loved this free service and want to know what goes into making it possible, have a read of the donations page. Buy me a coffee or a beer or just some time with the kids at a movie.

https://haveibeenpwned.com/Donate