¬ just serendipity 🍀 (not just serendipity)

Have I Been Pwned? by the great Troy Hunt:

Check if your email address is in a data breach

Individual sign-up #

Sign up and then verify your email:

You’ve just been sent a verification email, all you need to do now is confirm your address by clicking on the link when it hits your mailbox and you’ll be automatically notified of future pwnage. In case it doesn’t show up, check your junk mail and if you still can’t find it, you can always repeat this process.

The email:

You (or possibly someone else), just subscribed {email} to the notification service that will automatically let you know if your address is caught up in a future data breach. It’s a free service and you can unsubscribe at any time if you don’t want the notifications.

Just to confirm that you’re a real person behind a real email address, click on the link below then you’ll be automatically subscribed to new breach notifications where this email address has been pwned.

Then:

Verification complete

All done, you’ll be sent an email if this address gets pwned in future, below is your existing exposure

There’s a lot of lore in the PWNED — The Collected Blog Posts book by Troy Hunt & Rob Conery, which I would recommend.

Domain sign-up #

Furthermore, there’s also a domain search service:

Search for pwned accounts across an entire domain and receive future notifications.

Domain search allows you to find all breached email addresses on a domain you control via a dedicated domain search dashboard. Once verified, you will also receive notifications via email if they appear in future breaches. Before you can perform a domain search, you need to verify your email address and that you control the domains you’re searching. If you cannot verify that you control a domain, you will not be able to search for breached email addresses on it.

Upon signing up:

Welcome to the Have I Been Pwned domain search

You (or possibly someone else), just began the process to access the domain search dashboard using the email address {email}. Just to confirm that you’re a real person behind a real email address, click on the link below which will take you to the dashboard (the link will remain valid for 60 minutes).

Then you can choose a way to verify your domain:

• with a pre-defined address like security@ or webmaster@ or postmaster@ or hostmaster@
• with a DNS TXT record

When following the first route:

An email containing a verification token has been sent off to the address you chose, just copy and paste it into the text box below and you’ll be able to perform the domain search right after that.

I was already familiar with the individual service, but only now discovered the domain service, at work, by happenstance.