Hacker News Reader

This kind of data shouldn't be accessible by people who do not own the email address..

Why?

Also HIBP has a "domain search" for sysadmins: https://haveibeenpwned.com/DomainSearch

If you just want to check if the passwords of users of your service have been breached, there is a separate API for that: https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByR...

People who create/release dumps that these tools check tend not to be too focused on account security....

C'mon, there is a difference between breaching into servers and leaking/selling people's data and intentionally making all of that public and accessible through a public API

Give me your email address and I can know your name + address + phone number + history of old passwords + browsing history and more personal data

But who am I to care about that kind of things, screw people right

Yeah let's give the bad guys all the ease of use while we put up obstacles for legitimate users

You misunderstood, I'm not against this service, I'm against making the data available to people who do not own the email address, big difference that people don't seem to understand over here

Wich explain the lack of care for privacy and security in the west, boy 2024 will be fun..

Privacy washing is a thing apparently

Reply on news.ycombinator.com