3 ms·
You're only sending part of the hash here, the potential evil password-checking service wouldn't know who's sending the request or where this password is used.
by ajnin 9y ago
You're only sending part of the hash here, the potential evil password-checking service wouldn't know who's sending the request or where this password is used. All he'd know is the originating IP address. I don't know a way to link a particular IP to an online service username, which would be major news.
Presumably in that case 1Password is sending the requests from their own servers, so the whole range of 1 million prefixes would be quickly explored, giving no information at all to the password-checking service.
- zaroth 9y agoI agree completely. You're sending a prefix which is good enough to reject 99.9999% of candidate passwords. Maybe you're fine sending that prefix to TroyHunt or to 1Password because you trust they won't try to use it against you. I'm not passing judgement of whether they are trustworthy. But I do think it should have been mentioned in all the back-patting around "k-anonymity" exactly how useful or not the prefix would be in the hands of an attacker. The argument that "the attacker won't know which user the prefix belongs to" is certainly a big qualifier that would make access to the prefixes less useful. Can we be certain that always holds true? Certainly in the case of 1Password the user is sending their hash prefixes in a way that directly identifies the user's identity to 1Password, and anyone who can snoop on that communication. This is also true for anyone using the HIBO webform directly to submit their favorite passwords.