0

HIBP is a great service that I've been using for a long time.

I had a question surrounding Domain Search feature on HIBP. I believe there has to be some form of verification from our end in order to search for breached accounts by domain. How are the Threat Intelligence companies bypassing this? when all we provide to them are various domains as keywords and they are able to provide us with all the breached emails. Is there a way for us to download the entire email dump for a particular breach? It would be great if you could provide some clarity here!

Improve this question
5
  • 3
    I asked Troy Hunt directly. Should have an answer for you before too long.
    – Polynomial
    Apr 18, 2019 at 16:52
  • Haha, I had reached out to him too! But haven't received response yet and I end up posting the question here. Keep us posted!
    – Data Shark
    Apr 18, 2019 at 17:34
  • Is there a reason you believe these threat intelligence companies are getting their data from HIBP? I would assume that most of them gather dumped credential data from the source just like Troy does.
    – PwdRsch
    Apr 18, 2019 at 19:24
  • Because the following is explicitly mentioned in their reports "This data has been secured from the "HaveIBeenpwned" repository."
    – Data Shark
    Apr 18, 2019 at 22:25
  • Interesting. My understanding is the same as yours, that your org's admins would have to verify 'ownership' in a way that a third party could not. I just confirmed that even verifying it once is only good for a 60 minute window to download the results. Seems like they have to be misattributing the source of their data.
    – PwdRsch
    Apr 18, 2019 at 23:48

1 Answer 1

Reset to default
1

Here's the answer from the CTI Vendor. (Name replaced with Vendor X)

For HIBP, Vendor X had a custom and paid integration. Vendor X paid HIBP a fee whenever a new breach (which Vendor X did not have) was acquired by HIBP. Therefore, we did not use the Open API, we built a custom integration that pushed any new breach acquired by HIBP into the Vendor X portal. This was the reason no passwords were ever present in HIBP breaches in Vendor's portal (paid service), because under UK and GDPR law, any exchange of PII (including passwords) between any two entities, where money is involved, is a crime.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .