What are the risks of posting my email address to pwnedlist.com?

Question

pwnedlist.com claims to have details of over 23 million accounts that have been hacked, and if you submit your email address they'll apparently tell you if you're in the database.

Are the people running the site are reputable, or might they add your email address to a database of worthwhile targets? (perhaps ignore the latter part of that question, as it's unanswerable)

Has anyone personally used the site? If your email is on the list, what information are you given? (They just say you can "see if it's on our list.") Are there any issues with submitting someone else's email address?

Answer 1

I'm sure spammers have created sites like to get lists of email addresses but...

You can also use a SHA-512 hash of your email as input

based on this I think you can just submit your SHA-512 and not worry about spam since if they can reverse the hash it means they've already got your address, and aren't collecting new ones: The only information you are giving them is that your email is active, you care about security and your IP and useragent.

(Although I reject the value of such sites.. just change your password if you are worried)

Answer 2

Here's what happens if you're not on the list: http://i.imgur.com/zfHp1.png

There's nothing more at the end of the page. Basically they try to get you to use one of their password managers. There is no way to tell if this site is storing your emails, but I was ok with doing it with my secondary email because you don't have to give your password.

There are two potentially malicious things that a site like this could do with an email alone: add you to a target list, or add you to a spam list. I'll see if I start getting any spam, but doubt that I will because I think that a site this big is probably legit (or smart enough to make it seem as though they are*) and like to think that spam filters are sophisticated enough to block random messages (unlike my phone which keeps getting calls for a free cruise).

Ultimately, I agree completely with @xce, and think that changing your password regularly is the best bet. When it comes to your email address, I would be more concerned about password strength or simply a server side vulnerability (like what happened with Yahoo) then anything else. Usually in either case you'll be aware, as the hacker wants to do something with your email. If you're completely worried that you're already hacked by a passive hacker, switch to a new email address, make a much stronger password and switch all of your email addresses diligently. This is typically more work than it's worth, in my opinion. Unless you work for the Government maybe.

Edit: *added necessary skepticism

Answer 3

if you use the hash,they can not know your email adress unless it is in their db. On the other side 23 million adresses isn't a huge list, Spammers protect their lists quite well so it might be you are on one but your email isnt present in this particular db.