Who does have access to the actual eMail addresses or account names?
No one except us. The eMail addresses and account names provided to us, are not on the server. We just stored the hashes on the server. Only hashes are transferred from the client to server. If you enter the eMail address or account name, it is immediately hashed on the client side and never stored.
Why can’t I search for a whole domain or with a wildcard?
We did not store eMail addresses or account names on the system, only hashes. This makes a wildcard search impossible by design. Apart from that, we have privacy concerns, if one can basically have a look at all eMail addresses or account names. If a provider or organization would like to have a search for a whole domain, we can do that offline. Please provide some proof that you are really responsible for the domain.
Why did you do this? Why did you not just pass the information to a site like haveibeenpwned.com?
We were not in the position to pass the raw data to another organization.
What else do you have to say?
Always use good passwords (long enough), choose different passwords for every account, use a 2 factor authentication whenever possible.
Why do we use Cloudflare?
We considered the risk of DDoS attacks to be very high. Cloudflare is an experienced DDoS mitigation provider. We decided to use a DDoS mitigation provider, not only for the protection of the tool itself, but also for the ISP where our server is located.
Does that mean that the server is located in an US cloud?
No, the server with the hashes is located in Switzerland. We just use Cloudflares network for DDoS mitigation. The IP address you see, when doing a lookup is the front-end server in the cloudflare network. This server does not store any data, but passes the requests to our backend system.