Server: Breached passwords alert

Created on 7 May 2017 · 11Comments · Source: bitwarden/server

Dashlane has this feature and I think it would be good to have it in bitwarden as well.

https://www.dashlane.com/features/security-alerts

enhancement

Source

ikoutone

All 11 comments

We could likely introduce some similar features using the HIBP API. https://haveibeenpwned.com/API/v2

kspearrin on 7 May 2017

Breach report added to web vault.

kspearrin on 10 Jun 2017

@kspearrin Unless I am misunderstanding the "Good News, Nothing Found!" mssage, the current implementation seems to only check the bitwarden login email against HIBO. Thats just saving you from going to the HIBO site. Why don't you sweep all the stored sites in the vault, find emails and then provide a checkbox based interface where you ask which of those emails you would like to check and then check each one?

gkrawiec on 16 Aug 2017

@gkrawiec That's correct. The report is really just there to make people aware of HIBP.

Automatically checking every unique email in your vault against HIBP database would be a violation of their API terms since that would result in an excessive amount API calls to their system.

kspearrin on 16 Aug 2017

thanks for the info. Didnt know that.

gkrawiec on 16 Aug 2017

Yea, their API only allows to check 1 email at a time, so we'd have to spam them.

kspearrin on 16 Aug 2017

Could we potentially have a button inside each login details page, allowing to check that login (both email & password) against HIBP? This should be within their terms

EDIT: I see that it's included in the windows desktop program by clicking the checkmark next to the obfuscated password. This would be useful for the web vault as well, and also for the username (if username is an email)

Techn1x on 4 Jun 2018

👍1

Seconded for checking individual username/emails, as I often use the '+string' feature of gmail (and some others) to filter my email logins and protect against spam/breaches.