haveibeenpwned alternatives / data?

Submitted ⁨⁨2⁩ ⁨days⁩ ago⁩ by ⁨Deebster@infosec.pub⁩ to ⁨selfhosting@slrpnk.net⁩

My personal domain has hundreds of aliases - one for each site I deal with. This is great for identifying the source of spam, and I retire any alias that get spam.

haveibeenpwned.com lets me add a domain, but wants 3912 USD a year to actually tell me which addresses leaked. This is obviously an insane price for a nice-to-have.

Is there an alternative for free or very cheap? A self-hosted tool that would pull down lists would be great, but I suppose those lists aren’t public.

source

Comments

Sort:hotnew top

kungen@feddit.nu ⁨2⁩ ⁨days⁩ ago
If I recall, the founder had some workaround for situations like you describe. I am in the same situation but I didn’t have the effort to care enough to do all that hassle.

source
- Deebster@infosec.pub ⁨2⁩ ⁨days⁩ ago
  It’s entirely possible that my best fix is just to delete my haveibeenpwned account and just react when I see spam, but where’s the fun in that?
  
  source
- Deebster@infosec.pub ⁨2⁩ ⁨days⁩ ago
  The founder was asked to provide a subscription level for individual domains and he said no and pointed people at the suggestion to occasionally pay for a month instead.
  
  HIBP subscriptions can be taken out monthly and cancelled at any time. If the appearance of your domain in a breach is infrequent, you can take out a one month subscription then immediately cancel it after performing the search (the subscription will remain active until the entire month period has elapsed).
  
  source
vk6flab@lemmy.radio ⁨2⁩ ⁨days⁩ ago
I am not sure what you are talking about.

I have a domain registered and can see exactly which addresses have been compromised by what, without payment.

source
- Deebster@infosec.pub ⁨2⁩ ⁨days⁩ ago
  I see this:
  
  Domain search restricted: You don’t have an active subscription so you’re limited to searching domains with up to 10 breached addresses (excluding addresses in spam lists). Only results for subscription-free breaches are shown below, upgrade your subscription to run a complete domain search. If you believe you’re seeing this message in error, make sure you’re signing in to the dashboard with the correct email address (check your latest receipt if you’re unsure).
  
  source
  - vk6flab@lemmy.radio ⁨2⁩ ⁨days⁩ ago
    Interesting.
    
    I see a list of email addresses.
    
    source
    -> View More Comments
mistermodal@lemmy.ml ⁨2⁩ ⁨days⁩ ago
$4000 USD a year he better be delivering caviar to your doorstep (that shit is cheap now)

source
- BarbecueCowboy@lemmy.dbzer0.com ⁨2⁩ ⁨days⁩ ago
  It’s because of Enterprise contracts, for the things you can check off with HIBP… 4 grand is not a lot for them. But, then also if you offer a separate plan and just say ‘no enterprise, we trust you’, many businesses will just ignore the enterprise plan.
  
  source
iz_ok@sh.itjust.works ⁨2⁩ ⁨days⁩ ago
Maybe not an exact fit for your situation and would take work but I use addy.io. solid and have had no issues with it for 4+ years.

source
- Deebster@infosec.pub ⁨2⁩ ⁨days⁩ ago
  If it takes me on average 5 minutes to login and change an email address, it would take me about 1 days, 18 hours to change them all! It definitely looks worth it for others who want to start using aliases.
  
  source
9tr6gyp3@lemmy.world ⁨2⁩ ⁨days⁩ ago
Just register a new domain and route that mail to your old domain.

source