5 ms·

While in good intentions, this project has the potential to concentrate large amounts of power. Who decides what website is "valid" or not? Just as internet com

by wyc 9y ago

While in good intentions, this project has the potential to concentrate large amounts of power. Who decides what website is "valid" or not? Just as internet companies such as Google and Facebook, unwittingly or not, have become the gatekeepers of news, this would create a similar power structure for websites. Competitors? Spend money hacking one of their lower-priority services to get an entry on haveibeenpwned.com and then a flag on the Firefox browser. While these power structures are concerning, we should be careful before calling it off prematurely as clearly consumers could stand to benefit a lot from such a service. If the service was coupled with ruthless transparency and digestible explanations, it could be far fairer. A list of "exploited vulnerabilities within the past 2 years", summaries, and references may be more forthcoming than an oversimplified flag indicating "bad or not".

sverhagen 9y ago
Likely a considerable group of users will ignore a "bad" flag, as much as they have been ignoring all sorts of flags in the past. The less black and white (red or green) the flag is, seems to me, the more people will ignore it.
st3fan 9y ago
Did you read the article? Firefox is not going to tell you if a site is good or bad. It is going to tell you: “Firefox is working on the feature in collaboration with "Have I Been Pwned," the popular site that can check your email and tell you if your credentials have been stolen by hackers.“ There is nothing subjective about this. If your email is in the HIBP list you are possibly screwed. This is very real, based on real data.
- wyc 9y ago
  Yes, I did. Particularly this part: > If you visit a site on Have I Been Pwned's naughty list, it will throw a flag stating, "You visited hacked site ashleymadison.com." This does more than just tell users if their credentials have been compromised. That copy is likely to affect traffic in a manner similar to invalid HTTPS certs. Wouldn't you agree that some degree of subjectivity lies within the specific partnership with Have I Been Pwned and its submissions? Popular does not mean just. A lot of this is contingent on how the user interface and data are presented in the program. That "there is nothing subjective about this" may be true for only a facet of the whole issue. No doubt, there are potential benefits for everyone here, but some of the worst outcomes have resulted from the best intentions.
  - spdustin 9y ago
    Can you clarify how HIBP could be perceived as either unjust or subjective?
    - ajcodez 9y ago
      To the extent data breaches are only committed by external bad guys it’s fine. If hacking a competitor causes a user visible flag, there is now incentive.
      - ygjb 9y ago
        How is a breach from a competitor, who is doing it for financial motives, different from an "external bad guy" who is doing it for financial motives?
        ajcodez 9y ago
        It's a little different because the competitor does not want the digital assets being hacked, but rather just wants the hack to be on record.
      - reitanqild 9y ago
        Hopefully this will also be an incentive for website owners to let developers spend time on security to avoid getting hacked.
      - Dylan16807 9y ago
        That could happen from any measure that makes people care about breaches. But I want people to care about breaches. I think it's worth the risk.
    - wyc 9y ago
      Here are a few reasons that I hope you find somewhat convincing: - Single point of failure. It's ran by one person who can be bribed or manipulated. I've never met Troy Hunt, and from what I can tell he looks like a great upstanding guy[1], but $5 wrenches will work on my kneecaps too. - What's the process for reporting and publishing? Appeals? There's no transparency here, aside from a list of 5 one-sentence steps in the FAQ[2]. How do we decide what data are "sensitive"? My guess is that there's not too much review. - As hinted above, with a publicly available shame list, there would exist new incentives to get competitors and enemies on the list. How does this play with a loosely documented review + publish process? With a user interface that might oversimplify the issue? Please don't misunderstand these points as hostility. I really really like Have I Been Pwned and think it's amazing what Troy is doing. It's just that if we're building new web infrastructure, it's important that we get it right. I think where we can agree is that web users deserve more control over their data by default and shouldn't have to learn how to install and use several fringe programs to do so. [1] https://haveibeenpwned.com/About https://haveibeenpwned.com/About [2] https://haveibeenpwned.com/FAQs https://haveibeenpwned.com/FAQs
kodablah 9y ago
> While in good intentions, this project has the potential to concentrate large amounts of power. Compare this concern with Google's "Safe Browsing" lists. Granted that's more for phishing, but it definitely could be troubling if used incorrectly. All we can ask is users be vigilant about abuses.

by wyc 9y ago

sverhagen 9y ago

Likely a considerable group of users will ignore a "bad" flag, as much as they have been ignoring all sorts of flags in the past. The less black and white (red or green) the flag is, seems to me, the more people will ignore it.

st3fan 9y ago

Did you read the article? Firefox is not going to tell you if a site is good or bad. It is going to tell you: “Firefox is working on the feature in collaboration with "Have I Been Pwned," the popular site that can check your email and tell you if your credentials have been stolen by hackers.“ There is nothing subjective about this. If your email is in the HIBP list you are possibly screwed. This is very real, based on real data.

wyc 9y ago
Yes, I did. Particularly this part: > If you visit a site on Have I Been Pwned's naughty list, it will throw a flag stating, "You visited hacked site ashleymadison.com." This does more than just tell users if their credentials have been compromised. That copy is likely to affect traffic in a manner similar to invalid HTTPS certs. Wouldn't you agree that some degree of subjectivity lies within the specific partnership with Have I Been Pwned and its submissions? Popular does not mean just. A lot of this is contingent on how the user interface and data are presented in the program. That "there is nothing subjective about this" may be true for only a facet of the whole issue. No doubt, there are potential benefits for everyone here, but some of the worst outcomes have resulted from the best intentions.
- spdustin 9y ago
  Can you clarify how HIBP could be perceived as either unjust or subjective?
  - ajcodez 9y ago
    To the extent data breaches are only committed by external bad guys it’s fine. If hacking a competitor causes a user visible flag, there is now incentive.
    - ygjb 9y ago
      How is a breach from a competitor, who is doing it for financial motives, different from an "external bad guy" who is doing it for financial motives?
      - ajcodez 9y ago
        It's a little different because the competitor does not want the digital assets being hacked, but rather just wants the hack to be on record.
    - reitanqild 9y ago
      Hopefully this will also be an incentive for website owners to let developers spend time on security to avoid getting hacked.
    - Dylan16807 9y ago
      That could happen from any measure that makes people care about breaches. But I want people to care about breaches. I think it's worth the risk.
  - wyc 9y ago
    Here are a few reasons that I hope you find somewhat convincing: - Single point of failure. It's ran by one person who can be bribed or manipulated. I've never met Troy Hunt, and from what I can tell he looks like a great upstanding guy[1], but $5 wrenches will work on my kneecaps too. - What's the process for reporting and publishing? Appeals? There's no transparency here, aside from a list of 5 one-sentence steps in the FAQ[2]. How do we decide what data are "sensitive"? My guess is that there's not too much review. - As hinted above, with a publicly available shame list, there would exist new incentives to get competitors and enemies on the list. How does this play with a loosely documented review + publish process? With a user interface that might oversimplify the issue? Please don't misunderstand these points as hostility. I really really like Have I Been Pwned and think it's amazing what Troy is doing. It's just that if we're building new web infrastructure, it's important that we get it right. I think where we can agree is that web users deserve more control over their data by default and shouldn't have to learn how to install and use several fringe programs to do so. [1] https://haveibeenpwned.com/About https://haveibeenpwned.com/About [2] https://haveibeenpwned.com/FAQs https://haveibeenpwned.com/FAQs

kodablah 9y ago

> While in good intentions, this project has the potential to concentrate large amounts of power. Compare this concern with Google's "Safe Browsing" lists. Granted that's more for phishing, but it definitely could be troubling if used incorrectly. All we can ask is users be vigilant about abuses.