3 ms·

HIBP now has an API for testing if passwords have been pwned that preserves the secrecy of the password. It's called k-anonymity, and you can read about it in t

HIBP now has an API for testing if passwords have been pwned that preserves the secrecy of the password. It's called k-anonymity, and you can read about it in the second half of https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...

ninkendo 9y ago
I figure it’s easy to do something like this by generating a nonce over a TLS connection and using it as a shared salt value, and just checking if the hashes of the two passwords match when using the nonce as a salt. Not sure what k-anonymity is but I wouldn’t be surprised if it’s something similar. Edit: nope, looks like k-anonymity basically lets you search by the first few characters of the sha512 hash, and it responds with all of the hashes that have that as the first few characters, along with the count for each (how many people use that password, likely.)
- eridius 9y ago
  Yeah. It produces a response that’s small, easy and fast to generate, easy and fast to parse, without actually telling the server much of anything (all the server learns is that it isn’t a password whose hash starts with something else, but that barely narrows the search space).
- tonyztan 9y ago
  Direct link to k-anonymity section: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...
Sylos 9y ago
Mozilla also uses this k-anonymity in their implementation of Google Safe Browsing. (As they need to ask Google's server, if the webpage you're visiting or the file you're downloading is safe, without telling Google the webpage/file that you are visiting/downloading.) Pretty good documentation on that: https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-... Another idea here, stolen from Mozilla's implementation, would be to add in a few noise entries when making a request. So, if the user types in their password and the hash evaluates to "2e78f...", you would send off the request for that range and also send off requests for a handful of random, other ranges. In effect, this isn't particularly different from using less symbols to denote the range, e.g. asking for "2e78" instead of "2e78f". But that gives you 16 times as many results, whereas with noise entries, you can fine-tune it to give you for example only 5 times as many results (with 4 noise entries, that is).

ninkendo 9y ago

I figure it’s easy to do something like this by generating a nonce over a TLS connection and using it as a shared salt value, and just checking if the hashes of the two passwords match when using the nonce as a salt. Not sure what k-anonymity is but I wouldn’t be surprised if it’s something similar. Edit: nope, looks like k-anonymity basically lets you search by the first few characters of the sha512 hash, and it responds with all of the hashes that have that as the first few characters, along with the count for each (how many people use that password, likely.)

eridius 9y ago
Yeah. It produces a response that’s small, easy and fast to generate, easy and fast to parse, without actually telling the server much of anything (all the server learns is that it isn’t a password whose hash starts with something else, but that barely narrows the search space).
tonyztan 9y ago
Direct link to k-anonymity section: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...

Sylos 9y ago

Mozilla also uses this k-anonymity in their implementation of Google Safe Browsing. (As they need to ask Google's server, if the webpage you're visiting or the file you're downloading is safe, without telling Google the webpage/file that you are visiting/downloading.) Pretty good documentation on that: https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-in-firefox/ https://feeding.cloud.geek.nz/posts/how-safe-browsing-works-... Another idea here, stolen from Mozilla's implementation, would be to add in a few noise entries when making a request. So, if the user types in their password and the hash evaluates to "2e78f...", you would send off the request for that range and also send off requests for a handful of random, other ranges. In effect, this isn't particularly different from using less symbols to denote the range, e.g. asking for "2e78" instead of "2e78f". But that gives you 16 times as many results, whereas with noise entries, you can fine-tune it to give you for example only 5 times as many results (with 4 noise entries, that is).