I think the authors exuberance and self congratulatory sentiments seem misplaced. From the article: >"HIBP is Becoming the "Go-To" Resource for Protecting Acco

I think the authors exuberance and self congratulatory sentiments seem misplaced. From the article: >"HIBP is Becoming the "Go-To" Resource for Protecting Accounts" No "protecting" accounts" is something that is done internally at the source by companies storing user data. HIBP is offering a service that lets companies do CYA(cover your ass.) Companies can subsequently claim that they "notified" customers by telling them to check an external website. Responsibility is transferred to the customer and a third party. >"What that means for the industry is "a rising tide lifting all boats"; it's becoming more legitimate for all those doing the right thing with the data." No, doing the right thing with data is either protecting it or not storing it in the first place. HIPB is reactionary at best. The danger is that these companies with poor to no security practices continue to make no structural changes themselves. They simply use HIPB as a crutch do the least amount of actual work to protect data. This is supported by the following statement: >"Oftentimes, the first a company knows of a data breach is when I send them their data." It's hard to read that sentence and believe the author's assertion that "the industry has cleaned a lot/"