107

There is a new big case of stolen login/password data in the news. At the same time, I am reading that there are services that let you check if your own login data is affected, e.g. Have I Been Pwned.

Is it safe to enter my email address there to find out whether I need to change my passwords?

Tom K.
  • 7,913
  • 3
  • 30
  • 53
godwana
  • 931
  • 2
  • 5
  • 4
  • 54
    Yes, it is safe. haveibeenpwned.com is a well respected website run by a well respected individual. (Troy Hunt.) – Xander Jan 17 '19 at 13:25
  • 61
    Note that @Xander's comment only applies to that specific site - there are others which are also fine, but by no means all. Any site which asks you to provide the email address and password to check is best avoided (note that while HIBP does offer a password checker, it doesn't require any other data for that function) – Matthew Jan 17 '19 at 13:30
  • 26
    To be honest - can it be - has it been - independantly verified that `haveibeenpwned.com` is safe? I don't doubt it is, but really what I'm going on is little more than *trust*. Has there been any 3rd party penetration testing analysis? (open question) – Martin Jan 17 '19 at 14:32
  • 1
    @Martin Not that I know of, but even if there was a pentest or code audit a year ago, how would we know that the same code is used today? Even if the code was open source, how would we know if that was the version that was deployed? Then *in theory* a single request could be altered in such a way, that the data of specific users was handled differently. – Tom K. Jan 17 '19 at 14:37
  • A screenshot that all data in the `haveibeenpwned.com` database is encrypted at rest is a good start. But yes, trust only goes so far as the here and now, we can't trust `haveibeenpwned.com` tomorrow, based on this morning's assessment. *Oh dear, the paranoia is back.....* – Martin Jan 17 '19 at 14:40
  • 21
    Well to be honest, the worst what could happen @Martin is that Troy Hunt (which is a well known respected security author) has your email address. I actually have an email address to give to people so they can contact me, if that is the only PII I am giving out I'm not so worried ;) – Kevin Jan 17 '19 at 17:14
  • @KevinVoorn people contact each other by email? wow! What is this, the Dark Ages?! `;-)` p.s.> `haveibeenpwned.com` also deals with passwords .... – Martin Jan 17 '19 at 18:05
  • 1
    @Martin Yes already leaked passwords which are also not linked to an account when you type in a password, but I agree this would be more of an issue (although I still don't believe there is an issue) – Kevin Jan 17 '19 at 19:26
  • @TroyHunt - would you be interested in weighing in? TomK's answer below covers it, I think, but always happy to see posts directly from the horse's mouth. – Rory Alsop Jan 17 '19 at 21:19
  • Please note that some other people could find a way to take over the server. TroyHunt is just human after all and won't achieve a perfect protection in all directions. The best intentions don't change that. – deviantfan Jan 18 '19 at 07:04
  • 1
    @KevinVoorn to be fair, you (probably) enter your email, then go to the password page and enter your password. If HIBP wasn't safe, the password could then be stored into one of the best dictionary attack dictionaries ever. because you actually provided a password that had been save previously all by your own. – DonQuiKong Jan 18 '19 at 13:18
  • @Martin The site does deal with passwords. But it actually provides an API to securely look up passwords in the database of leaked passwords. In those lookups the server doesn't learn the password, it only learns a few bits of a hash of the password. The number of bits the server learns is chosen to be small enough that the database will contain at least a handful of different leaked passwords which all match. – kasperd Jan 18 '19 at 15:02
  • What thread model are you considering, where disclosing an e-mail address, and only an e-mail address, is potentially dangerous? – Matthieu M. Jan 18 '19 at 16:43

7 Answers7

98

This question was explained by Troy Hunt several times on his blog, on Twitter and in the FAQ of haveibeenpwned.com

See here:

When you search for an email address

Searching for an email address only ever retrieves the address from storage then returns it in the response, the searched address is never explicitly stored anywhere. See the Logging section below for situations in which it may be implicitly stored.

Data breaches flagged as sensitive are not returned in public searches, they can only be viewed by using the notification service and verifying ownership of the email address first. Sensitive breaches are also searchable by domain owners who prove they control the domain using the domain search feature. Read about why non-sensitive breaches are publicly searchable.

See also the Logging paragraph

And from the FAQ:

How do I know the site isn't just harvesting searched email addresses?

You don't, but it's not. The site is simply intended to be a free service for people to assess risk in relation to their account being caught up in a breach. As with any website, if you're concerned about the intent or security, don't use it.

Of course we have to trust Troy Hunt on his claims, as we have no way of proving that he is not doing something else, when handling your specific request.
But I think it is more than fair to say, that haveibeenpwned is a valuable service and Troy Hunt himself is a respected member of the infosec community.

But let's suppose we don't trust Troy: what do you have to lose? You might disclose your email address to him. How big of a risk is that to you, when you can just enter any email address you want?

At the end of the day, HIBP is a free service for you(!) that costs Troy Hunt money. You can choose to search through all the password databases of the world yourself if you don't want to take the risk that maybe a lot of people are wrong about Troy Hunt, just because then you would disclose your email address.

Community
  • 1
Tom K.
  • 7,913
  • 3
  • 30
  • 53
  • 72
    As mentioned before: this **only applies to haveibeenpwned.com**. Other services might be sketchy and sell your data off to spam providers. – Tom K. Jan 17 '19 at 14:14
  • 30
    `HIBP is a free service for you(!) that costs Troy Hunt money` I find this detracts from your answer as such services usually find a way to make money from the data you send them (e.g. targeted advertising). It doesn't answer the "is it safe" question anyway. – Aaron Jan 17 '19 at 16:24
  • @Aaron 1. As I said we cannot be sure that it is indeed "safe". 2. I wanted to show in my conclusion that the likelihood of this particular risk is - afaict - relatively low and the consequence of this risk is more or less negligible. – Tom K. Jan 17 '19 at 16:39
  • I agree we can't prove it is safe, but the rest of your answer still provides good arguments toward why we can reasonably trust the website. This part though in my opinion isn't an argument for but rather against whether we can reasonably trust it. – Aaron Jan 17 '19 at 16:43
  • 2
    Well, a lot of times there are pros and cons to a side. ;) I won't delete it, because *other* sites offer free services to then sell off your personal data. To infer that HIBP does the same without any proof seems very odd to me. – Tom K. Jan 17 '19 at 16:48
  • It's worth noting that you can hypothetically enter anybody's email address (it will say if it's been pwned, but not what on - which gets sent to your email account if you so choose to use the service), so even if you give the email address, it isn't associated to anything but your IP address and that's a tenuous association at best. No more or less risky than handing out your email address to any other service. – SE Does Not Like Dissent Jan 17 '19 at 16:54
  • 1
    @SSight3 It's worth noting, that this has already been noted in my answer. ;) – Tom K. Jan 17 '19 at 16:55
  • 1
    @TomK. I was cautiously giving an anecdote on experience to reinforce, but appears I worded it poorly. I should have worded my comment as 'you *can* enter someone else's email address'. Alternatively, anyone else can enter your email address. My only mild beef is it gives a 'pwned' response to any email to begin with, even if it's without which service (which infers you were on at least one of the pwned services), when it should simply just send the data in an email and give nothing to the casual browser. – SE Does Not Like Dissent Jan 17 '19 at 17:12
  • 6
    @Aaron The way Troy Hunt makes is money is by sponsorships on his blog and he is actually a keynote speaker on a lot of notable events. Besides that, he also creates Pluralsight courses which he obviously also makes money of. – Kevin Jan 17 '19 at 17:16
  • 1
    He also does not store email addresses next to passwords in his own database: you can search each independently, *but you can't search pairs.* As he, himself, acknowledged, [doing so would be incredibly dangerous](https://www.troyhunt.com/here-are-all-the-reasons-i-dont-make-passwords-available-via-have-i-been-pwned/). – Draco18s no longer trusts SE Jan 17 '19 at 18:04
  • 39
    Besides only applying to haveibeenpwned.com, this answer **only applies to haveibeenpwned.com as of the time this answer was posted**. A necessary caveat to any endorsement is that a service isn't guaranteed to be trustworthy for the remainder of its lifetime. A server can be hacked, a policy can be changed, a buyout can happen, a domain name can be seized, or a trustworthy guy could stumble into his supervillain origin story. – Future Security Jan 17 '19 at 20:23
  • 3
    @Aaron FYI Troy Hunt **is** doing targeted advertising... the site is clerly sponsored by 1password and considering whoever goes to that site is or might be interested in password security those ads are a form of targeted advertising – Giacomo Alzetta Jan 18 '19 at 08:27
  • 1
    @GiacomoAlzetta I think he was not refering to targeted advertising, merely to use PII for advertisement. A misunderstand of what 'targeted advertising' is, as it is one of the least intrusive forms of advertisement. – Kevin Jan 18 '19 at 21:54
  • @FutureSecurity : I know a lot of times people don't check their comments. I thought I'd just point out that this one, which you made, has been getting some up-votes. I, for one, appreciate the light-heartedness of your last few words (and appreciate the serious truth of the message as a whole). Thank you for such positive input. – TOOGAM Jan 19 '19 at 20:41
  • 1
    I'd like to point out – the minor privacy issue, not saying it is good or bad – that we can enter any email address at the website. This means I can enter a colleague's address and the service could tell me that my colleague's email address was pwned at websites A, B, and C, thus informing me that said colleague has an account at those websites with this email. – Daniel Jan 20 '19 at 16:11
  • 3
    @Daniel That is true, which is why all websites which could be damaging to someone (such as dating, porn etc.) are not disclosed on the website itself, rather to the email address you put in to keep it from being used in some sort of account enumeration. – Kevin Jan 21 '19 at 04:47
  • 1
    Personal anecdote: It just so happened that someone recently tried to login to my wife's email account with her actual password (the email provider decided it wasn't us and automatically blocked the attempt). Did the usual "change password" stuff and turned on 2FA on her account. Then I checked her old email and password on `haveibeenpwned`. Neither were marked as leaked. She still got pwned (well, at least they didn't get in). It's worth saying therefore that just because `haveibeenpwned` comes back clean doesn't mean that you're safe – Conor Mancone Jan 21 '19 at 13:58
16

Troy Hunt is a very respected Information Security professional and this service is being used by millions of people worldwide, even by some password managers to verify if the passwords selected by the users have been involved in a data breach.

See for example, https://1password.com/haveibeenpwned/

As per the website, 1Password integrates with the popular site Have I Been Pwned to keep an eye on your logins for any potential security breaches or vulnerabilities.

Entering your email address on this site will tell you which data breaches involve this email address, so that you can go back to the affected website and change your password. This is esp. important if you have used the same password for multiple websites, where credentials stolen from one site can be used to attack other sites in a technique also called Credential Stuffing attack.

The following StackExchange post has a response from Troy himself with further clarification on this service: Is "Have I Been Pwned's" Pwned Passwords List really that useful?

Vishal
  • 386
  • 1
  • 6
  • 2
    The linked question and answer by Hunt specifically deals with the "Pwned Password" feature. – Tom K. Jan 17 '19 at 20:32
  • @TomK. yes that is correct and I have provided the link above as a reference and an extension to this question, to put things in context further. – Vishal Jan 21 '19 at 18:12
14

You didn't explicitly ask about this, but it is very related to your question (and mentioned in the comments), so I thought I'd bring it up. In particular, some more details can give some clues on evaluating stuff like this.

The argument

haveibeenpwned also has a service that let's you look up to see if a given password has been leaked before. I could see this service being even more "questionable". After all, who wants to go around stuffing their password in a random website? You could even imagine a conversation with a skeptic:

  • Self: If I type my password in here it will tell me if it has showed up in a hack before! This will help me know if it is safe!
  • Skeptic: Yeah, but you have to give them your password
  • Self: Maybe, but even if I don't trust them, if they don't also know my email then it isn't a big deal, and they don't ask for me email address
  • Skeptic: Except that they also have a form that asks for your email. They probably use a cookie to associate your two requests and get your email and password together. If they are really sneaky they use non-cookie based methods of tracking so it's even harder to tell they are doing it!
  • Self: Wait! It says here that they don't send off my password, just the first few characters of my password's hash. They definitely can't get my password from that!
  • Skeptic Just because they say it doesn't mean its true. They probably do send off your password, associate it with your email (because you probably check your email in the same session), and then hack all your accounts.

Independent Verification

Of course, we can't verify what happens after we send them our data. Your email address definitely gets sent over, and there are no promises that they aren't secretly turning that into a gigantic email list that gets used for the next wave of Nigerian Prince emails.

What about the password though, or the fact that the two requests might be connected? With modern browsers, it is very easy to verify that your password isn't actually sent to their server. This service is designed so that only the first 5 characters of the hash of the password are sent off. The service then returns the hashes of all known passwords that start with that prefix. Then, the client simply compares the full hash against the returned ones to see if there is a match. Neither the password nor even the hash of the password are even sent.

You can verify this by going to the password search page, opening up your developer tools, and looking at the network tab (chrome, firefox). Put in a password (not yours if you're still worried) and hit submit. If you do this for password you'll see an HTTP request that hits https://api.pwnedpasswords.com/range/5BAA6 (5BAA6 being the first 5 characters of the hash of password). There are no cookies attached, and the actual submitted password never shows up in the request. It responds with a list of ~500 entries, including 1E4C9B93F3F0682250B6CF8331B7EE68FD8 which (at the moment) lists 3645804 matches - aka the password password has showed up about 3.5 million times in separate password leaks. (the SHA1 hash of password is 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8).

With only that information the service has no way to know what your password is, or even if it shows up in their database. There are a near limitless variety of hashes that might come after those first 5 digits, so they can't even guess whether or not your password is in their database.

Again, we can't know for sure what happens to the data after it leaves our browser, but they have certainly put a lot of effort into making sure that you can check to see if your password has leaked without actually sending them your password.

In summary, Troy is definitely a respected member of the community, and there are aspects of this that we can verify. Certainly, there have never been any cases where trusted members of a community later break that trust :) I definitely use these services, although I don't know if you want to trust some random person on the internet. Then again, if you weren't willing to trust some random person on the internet, then why are you here?

Community
  • 1
Conor Mancone
  • 29,899
  • 13
  • 91
  • 96
  • 5
    The site might send you different JS if you use an old vs. modern browser. It could detect whether the developer console is open. It could sample passwords 1:1000 to reduce chance of detection. It could submit the cleartext password on unload. Etc. And if you send a weak password it can be mostly identified from the first five characters (that's the entire point of the service). If you want to be paranoid about it, be thorough :) – Tgr Jan 19 '19 at 07:59
  • 1
    @Tgr :) I thought about adding some comments like that, but the point wasn't actually to make people paranoid, but rather to point out that the internet doesn't have to be a black box. There are helpful tools in almost every browser these days. – Conor Mancone Jan 19 '19 at 21:31
  • @Tgr Actually identifying a password from the first 5 characters of your hash is tricky. The only way to actually do that would be to take your password and your email and spam against a service where you are known to have an account. There are 300-500 passwords per hash "bin", so it would be plausible to brute force that few passwords against a weakly secured online service. If your password was in the list it could *potentially* be cracked that way. However, it could be tricky in practice. If you weren't using a leaked password, sending around your first 5 hash characters has no risk. – Conor Mancone Jan 20 '19 at 03:23
  • It's plausible to try that many passwords against pretty much any online service. Other than maybe banks, very few websites lock you out after a fixed number of failed login attempts (the harassment angle would be more problematic than the security one). Reasonable websites throttle logins so it might take 1-2 days to get through the list but that's all. Of course if your password cannot be leaked this is not a risk, but then if your password cannot be leaked why bother checking it? – Tgr Jan 20 '19 at 05:50
  • @Tgr Indeed. The "trickiness" is because you might not know what service to check. If you know for sure that someone has an account on a given service and they don't do throttling, you can pretty quickly brute force the passwords (as you say). If you get in then great (but not for them!). However, a lack of a match is trickier to diagnose. Do they not use that service? Did they use a different password than the one they checked? Did they use a different email on that service? It's definitely a plausible attack, but it won't have a 100% success rate. – Conor Mancone Jan 21 '19 at 13:45
  • Sure. It's the same kind of attack HIBP is intended to prevent: the attacker gets a bunch of username + password combinations from some weakly protected website, and tries them until they find one that matches; except in this case it would be username + 500 possible passwords. These kinds of attacks always go for quantity over likelihood - given lots of target accounts, it will probably work for some. – Tgr Jan 21 '19 at 23:03
  • Anyway if you are paranoid (and I don't think a normal user should be) you can download the full password (hash) dump from HIBP and search it locally. That won't tell you *where* the password was used but you usually don't care about that anyway. (Of course the original question was about email, not password; in that case I don't see any possible harm from using the online service, unless it's a super secret email address and you have put your phone number in it or whatever. But others have said that already.) – Tgr Jan 21 '19 at 23:06
2

Many answers here talk about the particular service "Have I Been Pwned". I agree with them that this service is trust worthy. I would like to say some points that applies in general to all these services.

  1. Don't use a service that asks for both email and password for checking.
  2. Use a service that allows you to check anonymously without requiring a sign in.

These services check data breaches that already happened. If your email address is in a breach these services and many others already know about it. Searching your email is not going to trigger anything new.

The maximum you get to loose in this case is that your email address is disclosed. But that is true for any website or newsletter.

Kolappan N
  • 2,662
  • 14
  • 26
  • 1
    Straight to the point and actually gives a rational explanation of why there is no actual risk involved in sharing your email. Voted up. – Kevin Jan 22 '19 at 03:47
-1

It really comes down to a few subjective questions about trust. How much trust is too much to ask? and... How much reliance on trust can we mitigate? Are the first two that come to my mind. Then I ask, who could get the data I'm afraid to give (ie my email address)? How little data can I give? How much do I trust the actors that could potentially get access to my data?

Now I'll attempt to answer these questions for myself and hopefully that will shed some light on how other's can answer it for themselves.

How much trust is too much to ask? Honestly, I don't know what it would take for me, I just know when I'm comfortable with it.

How much reliance on trust can we mitigate? I feel like the comments and replies above do a good job of illustrating what can be done so I won't rehash that here.

Who could get the data I'm afraid to give? Obviously Mr. Hunt could get it. It has been suggested that Cloudfire and possibly the NSA might be able to access it in part at least. Any bad actor could get a hashed partial of it with little to no context. Some of these seem far fetched enough that I'm personally willing to wager my privacy that it's likely only going to be Troy and to a limited extent, Cloudfire.

How little data can I give? Just my email, which I openly share to the public anyways, and if I return as compromised, than my passwords attached to that email but if that's the case, I'm already compromised so they could've gotten that anyways.

And finally; how much do I trust the actors that could potentially get access to my data? Well there's Troy Hunt... it has been said that he's a well known and respected member of the security community. It has also been pointed out that it's not like no respected member of the security community has ever violated earned trust. To that I would counter that he's too well known and documented to getaway with anything if he gets caught doing anything sketch like what's implied, I personally feel that's sufficient for me to trust him given all the other factors but that's just a judgment call so... As far as Cloudfire goes, I don't trust them as far as I can throw them, so I only trust the email check and not the password check. I do sometimes check passwords that have expired 3 or more iterations ago, as I know Google for example will give an alternate login option to reset your password (in the event of a forgotten password) and one of the alternate options is using the last password you remember using (as in old passwords) so I only test really old passwords of mine.

Hopefully that helps someone decided weather or not to trust it and if so to what extent.

binary_glitch
  • 1
-3

If you don't trust HIBP enough to give it your email but trust Mozilla (e.g. because you already gave them your email address for some other reason), you can use Firefox Monitor, a service Mozilla built in collaboration with HIBP. They query HIBP database without ever sending your email to HIBP. (I'm not sure if Mozilla receives your email address or if it's being hashed on the client side.)

user31389
  • 103
  • 2
  • 6
    This does not answer the question since Firefox Monitor qualifies as “a service *like* haveibeenpwned”, I think. You're just saying “don't trust service A, trust service B instead” while not explaining why anyone should trust a service like that in the first place. – Norrius Jan 19 '19 at 18:56
  • @Norrius Many people have already given Mozilla their email and it doesn't take any more trust to use their service. I'll add that to my answer. – user31389 Jan 21 '19 at 11:42
-9

Depends on what you mean by "secure," and how paranoid you are.

Just because the creator of the website is a security expert doesn't mean that the website has no security vulnerabilities.

The Website supports TLSv1.2 and TLSv1.3 which is great of course.

https://haveibeenpwned.com is using Cloudflare. As we all know Cloudflare is a Man in the middle. The encryption from the website is broken on the way to the actual server by Cloudflare.

Now, for example, the NSA could knock on Cloudflares door and let the data move over. But you don't have to be afraid of other attackers, because only Cloudflare and the actual target server can decrypt the data.

If you don't care if the NSA or other intelligence agencies get your data, which you sent to https://haveibeenpwned.com, then there should be no problem. Unless you don't trust the security expert.

Personally, I'd rather have my account credentials exposed than the Cloudflare (NSA) getting my data.

Note: This is only an answer for paranoid people. For those who aren't paranoid, other answers should work better.

Skiddie Hunter
  • 1,098
  • 2
  • 5
  • 12
  • 6
    I'm having a hard time even understanding your answer, in my opinion it is full of nonsense which is why I downvoted this answer. – Kevin Jan 21 '19 at 04:45
  • @KevinVoorn, Ok, I've revised my answer so that even those who don't understand so much about encryption can benefit. – Skiddie Hunter Jan 21 '19 at 22:53
  • Thank you for your clarification, although I am having trouble with ``Personally, I'd rather have my account credentials exposed than the Cloudflare (NSA) getting my data.``. I myself would not want to connect Cloudflare to the NSA (which is a personal view), but I don't see why there is a choice between either sharing your data with the NSA and having account credentials exposed. Maybe you could elaborate on that. – Kevin Jan 22 '19 at 03:45
  • Right, of course it is best if the credentials do not even reach the public in the first place. But in the worst case, if it does happen. What I mean by that is that if my credentials becomes public, I have a small time advantage to change my password before they find my email. This small time advantage does not exist with direct connections to the spy server. In the worst case, your email will be tapped directly and stored in a database. Now they have your e-mail address. Maybe this is really only for paranoid people. Assuming the owner doesn't work for any intelligence agency. – Skiddie Hunter Jan 22 '19 at 17:17
  • 1
    I don't think you know how the website works. When data (your email, password, etc.) is exposed in a data leak, that is when the websites stores the data and notifies owners if they want when they are part of a data leak. The database only keeps data from data leaks so there is no reason to fear your credentials becoming public because ``haveibeenpwnd.com`` leaks it, the data already is public. – Kevin Jan 22 '19 at 17:29
  • That's right. But my IP address remains even in the leaks unknown unless admin is retarded and stores the ip next to the user credentials. But if you send an email via the insecure espionage connection, the Central Intelligence can directly say: "Aha! The email address belongs to the IP address xy". Now they know where you live, because the majority don't use VPN or proxy. Then they got you. Mission failed. I assume the leaks only contain credentials and not IP Addresses. So they don't reveal IP addresses unless the service who leaked the data stores the log files in the same location. – Skiddie Hunter Jan 22 '19 at 21:12
  • I'm not really sure if you're trolling or not. If you are really worried about the CIA/NSA or something, I don't think your biggest problem is that your IP address is matched to an email address using the mentioned service. If the CIA/NSA or any other intelligence party wants to find you or information related to you, they will because they can ask your ISP for data, they can monitor and track you, they can follow you, they can tap the wires etc. So I don't see any more risk involved then mentioned earlier. – Kevin Jan 22 '19 at 21:15
  • [I moved the discussion to chat](https://chat.stackexchange.com/rooms/88648/discussion-between-kevin-voorn-and-skiddie-hunter). – Kevin Jan 22 '19 at 21:39