5 ms·
You can tune how much "a lot" is. In this case, the filter appears to be tuned for a 1 in 1000 false positive rate. How annoying that may be to your customers i
by zwily 8y ago
You can tune how much "a lot" is. In this case, the filter appears to be tuned for a 1 in 1000 false positive rate. How annoying that may be to your customers is up to you to decide. (I'm not sure about the utility in banning every exposed password ever anyway.)
You could also use this is a pre-check before querying the real haveibeenpwned api.
- FRex 8y agoDue to the fact how little 500 million passwords is out of the entire set of all possible passwords (even with single digit length) the 1 in 1000 false positive rate is extremely high actually. See my other comment: https://news.ycombinator.com/item?id=17323068 https://news.ycombinator.com/item?id=17323068
- philwelch 8y ago> You could also use this is a pre-check before querying the real haveibeenpwned api. Yeah, bloom filters are a fantastic pseudo-caching layer.
- slededit 8y agoTo me a cache is actually the inverse data structure of a bloom filter. A bloom filter will return whether something is in a set with potential false positives but never false negatives. A cache will return whether something is in a set but with potential false negatives but never false positives (i.e. item is not currently in the cache but exists in the set).
- tpetry 8y agoIf the bloom filter says the password has been breached before you check it against haveibeenpwnd database ;) So kind of a caching layer caching every password that has definitely not been breached.
- chii 8y ago> So kind of a caching layer ... i'd name this sort of thing a filter, rather than a cache.
- JackCh 8y agoCalling a bloom filter a filter is a tautology and tautologies don't have much pedagogical value. Explaining what a bloom filter is (and/or is useful for) by imperfect analogy to caching is less precisely correct than a tautology but will help the uninformed a lot more.
- philwelch 8y agoWell, that’s the pseudo- bit :)
- ghayes 8y agoReminds me of (clever?) demo site that disallowed passwords for users if they were valid logins to other common services. That is, it would present an error on registration "Please do not use your LinkedIn password."
- Kalium 8y agoThe implications of how they would need to implement that are a little scary.
- ahakki 8y agoI bet the message got the point across.
- infogulch 8y agoYeah but I bet the implementation brushes up against things that have been used to come to a conviction under CFAA. I'm no lawyer but it seems like a big liability to me.
- Kalium 8y agoYeah. When setting a password on a service, most people are not knowingly authorizing that service to use their credentials to try to log in to other services...
- Spivak 8y agoIt would actually be pretty cool if this was actually a service offered by those major services. Obviously very rate limited. Say example.com/.well-known/password-check You provide a username or email and a password and if you get it right it will let you know and lock their account and require a reset when they log on next. The someone like haveibeenpwned can run a meta service to check every service that registers with them. I haven't thought through the security implications of this but it seems pretty mild on the surface. I mean there's denial of service potential but only when their password has been compromised so... good?