Pwned or Bot
troyhunt.com
Pwned or Bot
1–10 of 89 posts
Re: Pwned or Bot
#2Maybe I'm an outlier but the e-mail-adress I use for online payments or shops for over 10 years now has not been pwned. Maybe because I don't use this email for other sites where no money is involved or for social media. But I think hibp is not a great bot indicator.
Re: Pwned or Bot
#3This is a cute "hack" for bot detection, but it's too unpredictable for the real world. Far too many users with good security hygiene are penalized by this system
Plus, this might incentivize hackers to defeat the system by logging into and using email accounts pwned in these breaches.
Re: Pwned or Bot
#4> If an email address hasn't been seen in a data breach before, it may be a newly created one especially for the purpose of gaming your system.
I’ve started using iCloud Hide My Email which generates a random email that forwards to my account email. This assumption is going to cause issues.
Re: Pwned or Bot
#5I pay for my email that gives me a lot of aliases and most of them have not been pwned yet. So with his tool I would be flagged as a bot. Honestly, doesn't sound like a great idea to be frank.
There must be large swaths of people that have either been careful or have specific emails that they use for certain purposes that haven't been pwned.
The question, what should happen if I haven't been pwned? Should I not be able to purchase the thing or would I face some annoying captcha?
I like Troy Hunt, but this idea penalize people with good habits and that is just something I can't support.
Re: Pwned or Bot
#6Facebook and Twitter are basically closed to new users. If you've gone this far without an account, your new one will be shut down for being a bot within hours of creating a new account, or flagged for "extra verification" which requires sending a government ID to these companies so they can verify that you didn't photoshop a fake government ID.
This new approach seeks to extend this feature to the entire internet. What could possibly go wrong?
Re: Pwned or Bot
#7> We're all so comprehensively pwned that if an email address isn't pwned, there's a good chance it doesn't belong to a real human.
Re: Pwned or Bot
#8> If an email address hasn't been seen in a data breach before, it may be a newly created one especially for the purpose of gaming your system. I’ve started using iCloud Hide My Email which generates a random email that forwards to my account email. This assumption is going to cause issues.
Next sentence addresses that:
> (…) or even using a masked email address service such as the one 1Password provides through Fastmail. Absence of an email address in HIBP is not evidence of possible fraud, that's merely one possible explanation.
Re: Pwned or Bot
#9This is just wrong. What about masked email accounts that you can create with services like icloud or fastmail?
Re: Pwned or Bot
#10I pay for my email that gives me a lot of aliases and most of them have not been pwned yet. So with his tool I would be flagged as a bot. Honestly, doesn't sound like a great idea to be frank. There must be large swaths of people that have either been careful or have specific emails that they use for certain purposes that haven't been pwned. The question, what should happen if I haven't been pwned? Should I not be ab…
Edit: I misunderstood Troy.
Original comment:
No, it doesn't penalize them (at least not his idea, implementations might), it simply fast tracks pwned emails and doesn't apply the normal bot checks that would otherwise apply to everyone.