Dashboard taxonomy

[troyhunt]

Now that we have the concept of a dashboard where all authenticated things happen, there should be a clear and logical taxonomy for content. Here's what I'm thinking, and it's a two-tiered structure with different options depending on your role:

1. Breach Summary (summary of breach exposure): Create an individual breach summary page to be shown on the personal dashboard #74
   1. Breach List (search the system and include sensitive breaches as the user is already auth'd): Verified user view of the breach exposure via their personal dashboard #76
   2. Stealer Logs (only needs to show if someone is in a breach flagged as a stealer log): Create a dedicated page to show stealer log exposure for an individual #78
   3. Notifications (ability to turn on notifications when you're in a breach, or confirm they're on at any time): Create a notify me page to sign up for emails then you're in a future breach #77
2. Subscription (show current state, take one out, upgrade it, cancel it): Dashboard: Subscription #79
   1. Domain Search (effectively the domain search page that has already been built, albeit with some tweaks): Migrate domain search results to new UX and clean up associated pages #71
   2. API Key: Dashboard page for API keys #73
3. Reseller (only visible to email addresses on a reseller domain)
   1. Customers (lists all the reseller's customers)

I feel that some of the verbiage here could be improved. For example, the first point is largely used by consumers, can we think of better names?

And on the resellers section (ugh), I think we're going to need to de-prioritise this work in the interest of actually getting a V1 of the new UI out, then pick this up after. Still capturing it here now as we do need it (again, "ugh").

[JimTheFrog]

I see notifications as separate from breach summary (it's not a summary, someone might be uninterested in notifications but periodically visit to see summary or vice versa). I would move it up a level into its own category.

Currently you have an email notification (https://haveibeenpwned.com/NotifyMe) a domain notification (https://haveibeenpwned.com/DomainSearch), and a password check (https://haveibeenpwned.com/Passwords). The last one isn't a notification, since of course you don't want to hold user's hashes, but I think people still might think of it as an "on-demand" notification. So I think all three should be on the Dashboard. Either include all three together in a "Check my security" section, with clear indications that the password check is immediate (and an explanation of why it can't be set up as a notification) and the other checks require ownership confirmation checks, or with the password check in its own top-level section.

I found the the lack of distinction between regular users, developers, and corporations (e.g. domain owners) a little confusing, especially on the first few visits. So, just spitballing here, what if the top levels of your taxonomy were more like:

1. General audience
   i. Check my password
   ii. Check my email
   a. Notify me when its in a new a breach or stealer log (or "Notify me when I'm pwned")
   b. Breaches [if any]
   c. Stealer logs [if any]
   iii. See who's been pwned (list of breaches) [but maybe you want this in the menu, not in the dash)
2. Developers
   i. API subscription (plus link to API overview)
   ii. RSS feed [or is this a general audience thing under "who's been pwned"?]
3. Organizations and domain owners
   i. Check my domain
4. Resellers
   i.

Is the dashboard only available after login? If not, then for "check my email" and "check my domain" (regardless of where they are in the taxonomy), you could have it change after the mail (or domain) is verified. I.e.:

• before verification:
  ii. Check my email
  a. Enter your email address:
• after verification:
  ii. Check my email (list email here??)
  a. ☑ Notify me when its in a new a breach

(If you plan for the dashboard to only be available after login, maybe you could revisit that, and have it serve more as the launch point for people who haven't signed up for anything yet.)

Re terminology, I think most of it's pretty clear, aside from ...

• "breaches" - until you teach users, they don't know what a "breach" is
  Alternatives:
  "Who's been pwned" is pretty good, but the "who" is vague and could mean users, not services
  "List of Pwned services"
  "Data leaks"
  "Data exposure list"
  "Digital break-ins"

• "stealer logs" -
  Alternatives:
  "Malware" -Users might know malware better than "stealer"
  "You've been exfiltrated!" - (hah, just kidding)