HaveIBeenPawned?

[amaury1093]

Add a field misc.have_i_been_pawned: true/false which makes an API call to https://haveibeenpwned.com/

[NChechulin]

There is a small problem: haveibeenpwned's API costs $3.50/month.
Maybe consider scraping or a similar free API?

[amaury1093]

Ah, I wasn't aware it was paid. So maybe not, I don't think it's super high priority (and people can always make a separate API call for that).

I recall the author was open-sourcing it. Will it still be paid after?

[NChechulin]

On API Key Page they provide a link to a blog post, which says:

Clearly not everyone will be happy with this so let me spend a bit of time here explaining the rationale. This fee is first and foremost to stop abuse of the API.

So, I think that we should not expect that API will become free soon.

[DigitalGreyHat]

Hello I made my own API. It's free forever! And it works the same as haveibeenpwned.com. I try to make a PR soon.
Edit: I am not a rust dev😅

[LeMoussel]

@DigitalGreyHat Can you give some/more information about your API?

[olivermontes]

hi, any news? @DigitalGreyHat

[sylvain-reynaud]

Hello, I am currently working on this.

There are my thoughts:

• The easy way to use HIBP API is to pay for it,
• we can use a headless browser to bypass cloudflare protection to call https://haveibeenpwned.com/unifiedsearch/user@example.org

The problem with the cloudflare bypass is that we have to rely on a stealth browser. Otherwise cloudflare will be triggered. https://github.com/ultrafunkamsterdam/undetected-chromedriver seems to be the one with the biggest community. I did a PoC and the results are not reliable. It works ~70% of the time (30% of crash/no response). Another problem of the slealth browser is that it brings a lot of new dependencies with its maintainability need.

To my mind, implement the paid API is the way to go. Otherwise we can find another reliable and free API.

[amaury1093]

Let's go with the paid API. @sylvain-reynaud would you like to create a PR?

I think the way to go is:

• add an env variable RCH_HIBP_API_KEY, if it's set to something non empty, then make an API call
• put the result in misc.have_i_been_pawned: Option<bool>

[amaury1093]

Otherwise we can find another reliable and free API.

Do people know of other free APIs? Ideally open-source. We can always add misc.<other_api> = true/false, and make those extra API calls configurable.

[sylvain-reynaud]

According to https://github.com/khast3x/h8mail#apis there are 3 free(ium) apis:

• https://breachdirectory.org/ (50 / month free)
• https://emailrep.io/ (250 free queries per month, up to 10 queries/day)
• https://hunter.io/pricing (25 free monthly searches)

[LeMoussel]

For information, there is Fingerprint Suite with Playwright.
It's OK with Antibot. I didn't test with Cloudflare.