I have been using LastPass for a while and I have just seen an option to generate an exposure report. By its output, I assume it checks various sources containing credentials dumps from hacked web applications for matches to my username / e-mail.
The output looks like the following:
some collection name
I am curious about how such applications work behind the scene. Also, is there a way to find out more about my exposed e-mail in such dumps (i.e. more sources).
I see that haveibeenpwned.com lists many breaches, so I could consume their API to validate against my known hostnames. As a side note,
somedomain.com is not listed by Pwned websites.
Question: How do applications such as password managers check leaked credentials and how can I get more results?