3 ms·

have i been pwned has an API: https://haveibeenpwned.com/API/v2 https://haveibeenpwned.com/API/v2

• ikeboy 10y ago
  Doesn't help without passwords, which present some ethical problems with helping spread them especially from that site as he gets some dumps that aren't public. With my idea the people with the data would be able to directly shut down the accounts ethically. Maybe the proposal could also hash and salt the passwords before sending it to the site, which sounds even better for security and wouldn't be too much of a hassle for whitehats who want to help.
• bigiain 10y ago
  Troy doesn't (for very good reasons) keep the passwords or hashes from breaches - just the email address. That make his API not quite capable of doing what's proposed here - Github can't use Troy's HIBP API to detect whether a breach containing my email address included a password that authenticates with them. (And I'm not sure there's even a way to make that service without creating _way_ more security problems than it solves...)
  • ikeboy 10y ago
    Do you see any blatant security problems with my proposal? The biggest problem besides DOS is that it leaks passwords to the site, which may prevent this from being useful except to trusted sites. But that can be solved by hashing/salting before uploading to the site, as long as the site publicizes their salting method (which shouldn't present security concerns, right?)