4 ms·
The combination of 'Baking HIBP into Firefox' and 'Cloudflare did some great work' and 'sends this to the API' just sounds bad. We are talking passwords here,
by auslander 8y ago
The combination of 'Baking HIBP into Firefox' and 'Cloudflare did some great work' and 'sends this to the API' just sounds bad.
We are talking passwords here, for god's sake, I want nothing be sent nowhere, let my browser and me alone.
- Operyl 8y agoOK, calm down for a minute. You need to read how k-Anonymity works before you continue to comment on this: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with... It isn't sending a plaintext password, not even a full hash of the password. This is entirely fine..
- auslander 8y ago> This is entirely fine.. ... until it doesn't. Any update on did this HIBP 'feature' made it into Firefox?
- Operyl 8y agoYou’ve yet to tell me when it’s not fine. Can you please provide some citations or technical reasonings besides just putting forward unsubstantiated claims? Below you've told jgahramc you refuse to read how it works, then you probably shouldn't make claims on this.
- frgewut 8y agoBugs can happen. One of the first scenarios that comes to mind - some implementation queries API for every key press. Suddenly you are sending your password out. I guess time will tell, but human-generated passwords have proven their ineffectiveness anyway.
- Operyl 8y agoThat’s still not a problem with Troy/Cloudflare/k-Anonymity. Bugs happen, sure, but I’d hope your password manager that stores all of your passwords, reliably, has unit tests to prevent that kind of failure scenario.
- jgrahamc 8y agoYou are arguing with yourself and haven't looked into how Troy's API service works. Worth reading: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with...
- auslander 8y agoPoint is, I trust Firefox, and it may lose my trust when it makes third-party API calls involving my passwords by default. Should I read how Troy's API service works? No.
- ocdtrekkie 8y agoI was very uncomfortable with Pwned Passwords until I read how it works. And even then, the true comfort blanket for me was writing a script that talked to it myself, so I could see exactly what info I was sending, and what info I was receiving back. I'm now entirely comfortable with this product/service. Read how it works.
- matthewmacleod 8y agoShould I read how Troy's API service works? No. Yes. Until you do that, you are arguing in utter ignorance - and you’re wrong, to boot.