News for hackers. Stuff that matters.

A comment on Project Svalbard: The Future of Have I Been Pwned. Parent comment

Re:Project Svalbard: The Future of Have I Been Pwned by samwillis on Tuesday June 11, 2019 @05:57AM (#20154074)
It’s a very easy fix, confirm ownership of the email address before exposing the results.
[ Parent | on HN ]
Re:Project Svalbard: The Future of Have I Been Pwned by jfdhu on Tuesday June 11, 2019 @09:05AM (#20155012)
Only if in possession of the email address or domain name. Where an email address or domain name has been taken over by someone else, then sending the results to the email address instead of currently showing it on the webpage doesnt solve the problem. This data set is ripe for blackmailers, intelligence services and any company looking for intelligence on rival businesses.
[ Parent | on HN ]
Re:Project Svalbard: The Future of Have I Been Pwned by _underfl0w_ on Tuesday June 11, 2019 @08:09AM (#20154684)
...if the password for said email address is already visible on the same page (assuming negligent password reuse) what kind of verification could you hope for?
[ Parent | on HN ]
Re:Project Svalbard: The Future of Have I Been Pwned by AshleyGrant on Tuesday June 11, 2019 @08:22AM (#20154742)
Have you actually used HIBP?
[ Parent | on HN ]