3 ms·

I really wish HIBH would actually send me the data related to my email. I currently have no way of know the current password except by going on to some shady we

I really wish HIBH would actually send me the data related to my email. I currently have no way of know the current password except by going on to some shady website and downloading a dump. Why not provide the option to send it to the user's email address?

emilburzo 10y ago
What's the shady website that has the dump? I'll go check it for you.
CameronBanga 10y ago
Why would this ever be valuable? Never mind it's probably a huge liability risk to Troy, who runs the service for free.
bigiain 10y ago
Ummmm, wat? You have no way to know the password you set on sites you signed up with, except from pastes of breaches? I don't think that's a problem Troy needs to fix... I think he's chosen very smartly to explicitly and publicly _not_ know anything about the passwords, and only store email addresses. If you think 60mil Dropbox passwords sounds like a spectacular fail, imagine the headlines if an attacker got into HIBP and exfiltrated 1.3_billion_ passwords (or password hashes)! It's be the first "Unicorn credential breach" ;-)
- Kadin 10y ago
  Except all those credentials are public anyway, so it has to be assumed that anyone who wants them, already downloaded them. Unless HIBP is getting its dumps from nonpublic sources..?
maruhan2 10y ago
So how does this work? Did the hacker go "Hey look, i managed to hack Dropbox, here are the data related because I trust you!" Or was it that HIBP managed to find where the data was?
raesene6 10y ago
Well in this case all you would have received is a salted hash without the salt, which would be pretty useless. So that's only useful where cleartexts are breached and there he'd then have the massive headache of securing that data. The best approach if this is a concern for you would be for you to store a password history of ones that you have used and when you changed them.

emilburzo 10y ago

What's the shady website that has the dump? I'll go check it for you.

CameronBanga 10y ago

Why would this ever be valuable? Never mind it's probably a huge liability risk to Troy, who runs the service for free.

bigiain 10y ago

Ummmm, wat? You have no way to know the password you set on sites you signed up with, except from pastes of breaches? I don't think that's a problem Troy needs to fix... I think he's chosen very smartly to explicitly and publicly _not_ know anything about the passwords, and only store email addresses. If you think 60mil Dropbox passwords sounds like a spectacular fail, imagine the headlines if an attacker got into HIBP and exfiltrated 1.3_billion_ passwords (or password hashes)! It's be the first "Unicorn credential breach" ;-)

Kadin 10y ago
Except all those credentials are public anyway, so it has to be assumed that anyone who wants them, already downloaded them. Unless HIBP is getting its dumps from nonpublic sources..?

maruhan2 10y ago

So how does this work? Did the hacker go "Hey look, i managed to hack Dropbox, here are the data related because I trust you!" Or was it that HIBP managed to find where the data was?

raesene6 10y ago

Well in this case all you would have received is a salted hash without the salt, which would be pretty useless. So that's only useful where cleartexts are breached and there he'd then have the massive headache of securing that data. The best approach if this is a concern for you would be for you to store a password history of ones that you have used and when you changed them.