Have I Been Pwned likely to ban resellers from buying subs, citing 'sh*tty behavior' and onerous support requests Troy Hunt, proprietor of data breach lookup site Have I Been Pwned, is likely to ban resellers from the service. Have I Been Pwned (HIBP) has gathered data stolen in 866 breaches and appearing at thousands of paste sites, and allows anyone to search for email addresses or text that trove contains. If personal info is present …
The whole idea of selling bulk access to HIBP seems to defeat its purpose.. The purpose is for end users to improve their security by changing credentials for accounts that have suffered data breaches. Whereas bulk access would allow a third party (perhaps a cybercriminal themselves) to fish for targets who might have forgotten to change their credentials, and to either target them with scams, or indeed go and purchase those leaked credentials on the dark web and see if they still work.
The point of bulk access is to allow large organisations such as corporations to be able to query against all their staff accounts. This helps the organisation keep their systems secure and at the same time the payments subsidise the free public access to personal users.
Troy is correct, the resellers who add no value are little more than parasites, you are also correct in that there is a risk if a Cybercriminal gets unfettered API access, but from memory (when I discussed this with our security manager, I’m not directly involved) the normal API access is limited to domains you can prove ownership of, probably via a DNS key of some kind.
I have this type of access for my family personal domain. A DNS key is how I prove ownership, I think there are some other options. I don't have to pay for that access. It also does not represent but less than 100 email addresses at most and many of those should never end up on HIBP. It allows me to alert family members when they have been pwned. I decided to do that after they never signed up with HIBP individually. It is for me almost a set it and forget it, until a breach results in any of those addys being in HIBP. I have contributed though, don't like to freeload.
I think there other types of API access with more "features" which would cost more time and resource. Those are the type scummy resellers (Cost Added Resellers CARs not VARs) latched onto.
I know of many cybersecurity firms who will happily do a "dark web" check for your passwords, where it's basically just regurgitated HaveIBeenPwned data with their brand on it.
I saw off at least two that my employers insisted I use because they actually didn't do anything that we couldn't do ourselves. Happy to have it as part of a "value-add" on an bigger service for convenience, but they were just reselling us HIBP content that we got in an email before they did.
HIBP has gone far more commercial in recent years, though, and I'm not sure of its utility as a ongoing paid-for service in the future except as part of such larger arrangements, so this might be cutting off his nose to spite his face. But that's for him to decide.
Ah, definitely anon for this.
Many large organisations seem to have outsourced their purchasing process to reseller firms (eg shi.com, one of the larger ones - I don't mean to infer they're the ones described in this article). The theory seems to be that they will be able to negotiate a better price or find a cheaper supplier, which might be fine if you're buying office furniture but when you have only one vendor supplying a particular product (eg our company, or Have I Been Pwned), they basically act as a middleman that take a percentage and do... nothing, other than slow down the process.
From an ISV point of view they actively remove value (we give them 5% as I recall) and the price for the customer is, presumably, the same, although it wouldn't surprise me if they're clipping there too. We'd ban them too, except that we'd probably lose a few sales to the large, inflexible dinosaur firms who also tend to be very good at renewing year on year...
What service!
There are many service providers that only accept card payments, or if they do offer a pay on invoice service it’s only for those customers who are making regular large purchases and have satisfied credit checking.
Troy, should probably increase reseller subscriptions that include support by x5 plus an admin fee if they don’t want to use card payments.
I didn't read the passage as "The resellers can't pay by credit card", I read it as "The resellers sell to people who can't pay by credit card, allowing them to access the service (and the reseller then pays HIBP by credit card)".
Which is a fair reason for a reseller to exist, imo, if the core provider isn't happy expanding payment options to people in difficult situations when it comes to paying online.
The other reason being centralised procurement. If you have a contract with a company to provide IT services, it can be a violation of the terms to purchase services like HIBP's without going through the service provider. In exchange for this requirement, the service provider assumes responsibility for ensuring that all subcontractors are vetted for security, offer good VFM and so on.
Only taking credit cards seems like a weird payment system too though. Seems like HIBP could achieve the same effect by just... choosing an intermediary payment processor that can do non-credit card payments for a small markup directly and cut out all resellers to begin with.
Some customers will need a written quote, perhaps in a certain format.
Some customers will insist on paying 30 days after they get the goods/services. Or 90 days.
Some customers will insist on certain terms in their contract.
Some customers will have a bunch of questions before they add a supplier as an "approved supplier".
It's not just a matter of "add another payment method". It's all the nonsense that some big companies insist on for the privilege of supplying them.
This is why resellers mark up the price so much. That covers their cost of dealing with this nonsense.
Just say no, man.
API / reseller access is this much per month, and we'll notify you of price increases.
Done.
Don't get into discussions about discounts, quotes, refunds, etc. at all if you don't want to provide those.
This is how much it costs. Like it or lump it. The cancel button is right there if you don't like it.
The issue here is companies with buying departments. That department procures everything from toilet paper to antimatter containment fields. The buyers have no technical knowledge of the product they are trying to obtain, it's just a part number to them, so trying to use technical reasoning with them will not work. You have 2 choices, 1) jump through all their hoops, 2) "This is the product and this is the price, and the service is provided as-is. Take it or leave it". Unless the customer is about to spend tens of thousands, I always go for option 2.
Oh, dear god, that!
I sell 60 USD / year subscriptions. I've had purchasing departments ask me for a host of documentation that would cost over a grand to issue, translate, Apostille, and mail(!), insist that I spend three hours to fill in an egregiously long and convoluted vendor vetting form, accept payment 90 days after delivery, or exchange dozens of emails just to issue a quote they will sit on for months before asking me to go through the whole charade all over again. I've also had some outright delusional companies who insisted I should bear banking expenses for the bank transfer, which are of course more than my profit margin.
Yeah, I politely tell them to pound sand. If they insist, I tell them okay, here's the self-checkout form, have one of your officers use their personal credit card to make a purchase, and reimburse them for a petty cash purchase. If they can't do that, well, sucks to be them.
Having been a VAR in the past (a consultancy that re-sold a product from another company as part of our solutions) the correct response is to have a specific reseller contract. This costs more, provides improved support, but also places expectations on the reseller (such as dealing with troubleshooting, always being 1st/2nd line support, and knowing how the product works). If you're not making money from a reseller, and getting notable extra volumes of business above direct sign ups, you're not doing it right.
It shouldn't even matter if the reseller isn't adding any discernible value. Maybe the value is as simple as being able to call the reseller on a phone, explain things in a manner the customer understands, or provide service in a way acceptable to the customer's accounts department. It's not relevant provided you make money from them.
From what I can see the pricing is far too inexpensive. If you price your service and support too low customers will overwhelm your resources. One of the best things current work did was to almost double the hourly charge for non business as usual requests; it moved the pain point from a situation where some customers would raise requests as it was easier or less expensive than navigating their internal bureaucracy, to one where now they only do so if it's absolutely necessary, and they work it out internally instead.
Parasites!
Having dealt with these sort of organisations, not only do they put massive markups on the products they on-sell, but they tell their customers that they are getting big discounts for them using their "buying power".
As Troy has pointed out - if a company really wants a product and can't get it through the official reseller, someone can put it on a company credit card.
