4 ms·

Naive soul here, but is it really wise to type live passwords into someone's site that ostensibly is looking for matches with its existing database? That seems

• ploxiln 8y ago
  The reasoning given is: if you're aware it's a bad idea, great! Don't do it. If you don't yet know it's a bad idea, and do it, you'll see how many places it has already been leaked, and hopefully start using different passwords, and a password manager ...
  • tqkxzugoaupvwqr 8y ago
    It trains average/non-IT people to enter their password on websites to “check”. If scammers start setting up mock websites that ask you to enter your password to see if your account was hacked, people will fall for it because they have been trained by white-hats that this is an acceptable practice.
    • acct1771 8y ago
      You have to dig to get to this feature. The consumer facing feature is entering your email address.
• austinjp 8y ago
  Troy Hunt's haveibeenpwned has a password checking facility at https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords He describes the security measures behind the process here: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity https://www.troyhunt.com/ive-just-launched-pwned-passwords-v... Of course, it all still boils down to how much you trust the guy, the approach, etc etc.
• deleted 8y ago
  [deleted]