Xrhrft

There is a new big case of stolen login/password data in the news. At the same time, I am reading that there are services that let you check if your own login data is affected, e.g.
Have I Been Pwned.

Is it safe to enter my email address there to find out whether I need to change my passwords?

This question was explained by Troy Hunt several times on his blog, on Twitter and in the FAQ of haveibeenpwned.com

See here:

When you search for an email address

Searching for an email address only ever retrieves the address from storage then returns it in the response, the searched address is never explicitly stored anywhere. See the Logging section below for situations in which it may be implicitly stored.

Data breaches flagged as sensitive are not returned in public searches, they can only be viewed by using the notification service and verifying ownership of the email address first. Sensitive breaches are also searchable by domain owners who prove they control the domain using the domain search feature. Read about why non-sensitive breaches are publicly searchable.

^{See also the Logging paragraph}

And from the FAQ:

How do I know the site isn't just harvesting searched email addresses?

You don't, but it's not. The site is simply intended to be a free service for people to assess risk in relation to their account being caught up in a breach. As with any website, if you're concerned about the intent or security, don't use it.

Of course we have to trust Troy Hunt on his claims, as we have no way of proving that he is not doing something else, when handling your specific request.

But I think it is more than fair to say, that haveibeenpwned is a valuable service and Troy Hunt himself is a respected member of the infosec community.

But let's suppose we don't trust Troy: what do you have to lose? You might disclose your email address to him. How big of a risk is that to you, when you can just enter any email address you want?

At the end of the day, HIBP is a free service for you(!) that costs Troy Hunt money. You can choose to search through all the password databases of the world yourself if you don't want to take the risk that maybe a lot of people are wrong about Troy Hunt, just because then you would disclose your email address.

Troy Hunt is a very respected Information Security professional and this service is being used by millions of people worldwide, even by some password managers to verify if the passwords selected by the users have been involved in a data breach.

See for example, https://1password.com/haveibeenpwned/

As per the website, 1Password integrates with the popular site Have I Been Pwned to keep an eye on your logins for any potential security breaches or vulnerabilities.

Entering your email address on this site will tell you which data breaches involve this email address, so that you can go back to the affected website and change your password. This is esp. important if you have used the same password for multiple websites, where credentials stolen from one site can be used to attack other sites in a technique also called Credential Stuffing attack.

The following StackExchange post has a response from Troy himself with
further clarification on this service:
Is "Have I Been Pwned's" Pwned Passwords List really that useful?

You didn't explicitly ask about this, but it is very related to your question (and mentioned in the comments), so I thought I'd bring it up. In particular, some more details can give some clues on evaluating stuff like this.

The argument

haveibeenpwned also has a service that let's you look up to see if a given password has been leaked before. I could see this service being even more "questionable". After all, who wants to go around stuffing their password in a random website? You could even imagine a conversation with a skeptic:

• 
  Self: If I type my password in here it will tell me if it has showed up in a hack before! This will help me know if it is safe!


• 
  Skeptic: Yeah, but you have to give them your password


• 
  Self: Maybe, but even if I don't trust them, if they don't also know my email then it isn't a big deal, and they don't ask for me email address


• 
  Skeptic: Except that they also have a form that asks for your email. They probably use a cookie to associate your two requests and get your email and password together. If they are really sneaky they use non-cookie based methods of tracking so it's even harder to tell they are doing it!


• 
  Self: Wait! It says here that they don't send off my password, just the first few characters of my password's hash. They definitely can't get my password from that!


• 
  Skeptic Just because they say it doesn't mean its true. They probably do send off your password, associate it with your email (because you probably check your email in the same session), and then hack all your accounts.

Independent Verification

Of course, we can't verify what happens after we send them our data. Your email address definitely gets sent over, and there are no promises that they aren't secretly turning that into a gigantic email list that gets used for the next wave of Nigerian Prince emails.

What about the password though, or the fact that the two requests might be connected? With modern browsers, it is very easy to verify that your password isn't actually sent to their server. This service is designed so that only the first 5 characters of the hash of the password are sent off. The service then returns the hashes of all known passwords that start with that prefix. Then, the client simply compares the full hash against the returned ones to see if there is a match. Neither the password nor even the hash of the password are even sent.

You can verify this by going to the password search page, opening up your developer tools, and looking at the network tab (chrome, firefox). Put in a password (not yours if you're still worried) and hit submit. If you do this for password you'll see an HTTP request that hits https://api.pwnedpasswords.com/range/5BAA6 (5BAA6 being the first 5 characters of the hash of password). There are no cookies attached, and the actual submitted password never shows up in the request. It responds with a list of ~500 entries, including 1E4C9B93F3F0682250B6CF8331B7EE68FD8 which (at the moment) lists 3645804 matches - aka the password password has showed up about 3.5 million times in separate password leaks. (the SHA1 hash of password is 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8).

With only that information the service has no way to know what your password is, or even if it shows up in their database. There are a near limitless variety of hashes that might come after those first 5 digits, so they can't even guess whether or not your password is in their database.

Again, we can't know for sure what happens to the data after it leaves our browser, but they have certainly put a lot of effort into making sure that you can check to see if your password has leaked without actually sending them your password.

In summary, Troy is definitely a respected member of the community, and there are aspects of this that we can verify. Certainly, there have never been any cases where trusted members of a community later break that trust :) I definitely use these services, although I don't know if you want to trust some random person on the internet. Then again, if you weren't willing to trust some random person on the internet, then why are you here?

If you don't trust HIBP enough to give it your email, you can use Firefox Monitor, a service Mozilla built in collaboration with HIBP. They query HIBP database without ever sending your email to HIBP. (I'm not sure if Mozilla receives your email address or if it's being hashed on the client side.)