Using hacked emails to verify users

A nice insight into how companies are using breached data to verify if emails are likely to be real people

It’s fascinating to see how creative people can get with breached data. Of course there’s all the nasty stuff (phishing, identity theft, spam), but there are also some amazingly positive uses for data illegally taken from someone else’s system. When I first built Have I Been Pwned (HIBP), my mantra was to “do good things after bad things happen”. And arguably, it has, largely by enabling individuals and organisations to learn of their own personal exposure in breaches. However, the use cases go well beyond that and there’s one I’ve been meaning to write about for a while now after hearing about it firsthand. For now, let’s just call this approach “Pwned or Bot”, and I’ll set the scene with some background on another problem: sniping.