My personal domain has hundreds of aliases - one for each site I deal with. This is great for identifying the source of spam, and I retire any aliases that get spam.
haveibeenpwned.com lets me add a domain, but wants 3912 USD a year to actually tell me which addresses leaked. This is obviously an insane price for a nice-to-have.
Is there an alternative for free or very cheap? A self-hosted tool that would pull down lists would be great, but I suppose those lists aren't public.
13 Comments
kungen@feddit.nu · 8 pts · 287d
If I recall, the founder had some workaround for situations like you describe. I am in the same situation but I didn't have the effort to care enough to do all that hassle.
Deebster@infosec.pub · 2 pts · 287d
The founder was asked to provide a subscription level for individual domains and he said no and pointed people at the suggestion to search manually or occasionally pay for a month instead.
Deebster@infosec.pub · 2 pts · 287d
It's entirely possible that my best fix is just to delete my haveibeenpwned account and react when I get spam, but where's the fun in that?
mistermodal@lemmy.ml · 3 pts · 287d
$4000 USD a year he better be delivering caviar to your doorstep (that shit is cheap now)
BarbecueCowboy@lemmy.dbzer0.com · 3 pts · 287d
It's because of Enterprise contracts, for the things you can check off with HIBP... 4 grand is not a lot for them. But, then also if you offer a separate plan and just say 'no enterprise, we trust you', many businesses will just ignore the enterprise plan.
iz_ok@sh.itjust.works · 2 pts · 287d
Maybe not an exact fit for your situation and would take work but I use addy.io. solid and have had no issues with it for 4+ years.
Deebster@infosec.pub · 1 pts · 287d
If it takes me on average 5 minutes to login and change an email address, it would take me about 1 days, 18 hours to change them all! It definitely looks worth it for others who want to start using aliases.
vk6flab@lemmy.radio · 1 pts · 287d
I am not sure what you are talking about.
I have a domain registered and can see exactly which addresses have been compromised by what, without payment.
Deebster@infosec.pub · 4 pts · 287d
I see this:
vk6flab@lemmy.radio · 3 pts · 287d
Interesting.
I see a list of email addresses.
Deebster@infosec.pub · 3 pts · 287d
Perhaps that message only shows up if some of the results are from the paid lists. For me, I don't see anything listed beneath, even though 34 addresses match, so I guess nothing's in the free lists.edit: Looks like it's triggered on number of results:
vk6flab@lemmy.radio · 3 pts · 287d
That's interesting, since my list of addresses contains numerous ones that don't exist and nobody here has ever used.
9tr6gyp3@lemmy.world · -4 pts · 287d
Just register a new domain and route that mail to your old domain.