4 ms·

Word of warning, if you use an ad/content blocker like uBlock Origin, and block 3rd-party JS, then HIBP may give up on its k-anonymity mechanism and just sends

Word of warning, if you use an ad/content blocker like uBlock Origin, and block 3rd-party JS, then HIBP may give up on its k-anonymity mechanism and just sends your password to their server in cleartext. Ensure you specifically permit loading jQuery from cloudflare.com, and check network traffic using a test password first.

deleted 8y ago
[deleted]
cheeze 8y ago
Why does this happen? It seems like a huge oversight to not detect ad blockers and let the user know that their password is being transmitted in plaintext if that's true...
morpheuskafka 8y ago
It's not cleartext if you're loading over HTTPS which is enforced on this site.
- majewsky 8y ago
  It's cleartext from the perspective of HIBP's server.
  - myself248 8y ago
    No it isn't: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with...
AlexITC 8y ago
I'm still impressed by the number of technical people that are willing to give you their passwords by a way or another, a common way being when they are offered to check if his password has been leaked. Once a friend shared with me one of those services, he got surprised when I raised my concern about compromising his password, he took a second to check the developer tools to see if there was any request including his password, there wasn't, so he called me crazy (it's well known that malicious sites behave differently on certain conditions, one is having the developer tools opened). Anyway, I suppose that this blind trust is what makes phishing attacks so effective.
- mehrdadn 8y ago
  > it's well known that malicious sites behave differently on certain conditions, one is having the developer tools opened I had always wondered if they do, and I've known it's possible, but this is the first time I've heard any accounts of it. Would you have more info on this?
  - ttsda 8y ago
    As someone who has worked on scraping sites that really didn't want to be scraped, there is all kinds of interference with dev tools in the wild. There are many ways to detect it's open (eg. https://github.com/sindresorhus/devtools-detect https://github.com/sindresorhus/devtools-detect) and it's also possible to mess with it without knowing it's open. A method that's wildly used is firing the debugger break command many times a second, along with other stuff that makes using the tools nearly impossible (slows the browser down to a halt)
    - bspammer 8y ago
      That script doesn't seem to be able to detect the chrome devtools when they're undocked, so that seems pretty easy to circumvent (who has them docked anyway?). The debugger break thing should be solvable with https://developers.google.com/web/tools/chrome-devtools/javascript/reference#force-resume https://developers.google.com/web/tools/chrome-devtools/java...

deleted 8y ago

[deleted]

cheeze 8y ago

Why does this happen? It seems like a huge oversight to not detect ad blockers and let the user know that their password is being transmitted in plaintext if that's true...

morpheuskafka 8y ago

It's not cleartext if you're loading over HTTPS which is enforced on this site.

majewsky 8y ago
It's cleartext from the perspective of HIBP's server.
- myself248 8y ago
  No it isn't: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with...

AlexITC 8y ago

I'm still impressed by the number of technical people that are willing to give you their passwords by a way or another, a common way being when they are offered to check if his password has been leaked. Once a friend shared with me one of those services, he got surprised when I raised my concern about compromising his password, he took a second to check the developer tools to see if there was any request including his password, there wasn't, so he called me crazy (it's well known that malicious sites behave differently on certain conditions, one is having the developer tools opened). Anyway, I suppose that this blind trust is what makes phishing attacks so effective.

mehrdadn 8y ago
> it's well known that malicious sites behave differently on certain conditions, one is having the developer tools opened I had always wondered if they do, and I've known it's possible, but this is the first time I've heard any accounts of it. Would you have more info on this?
- ttsda 8y ago
  As someone who has worked on scraping sites that really didn't want to be scraped, there is all kinds of interference with dev tools in the wild. There are many ways to detect it's open (eg. https://github.com/sindresorhus/devtools-detect https://github.com/sindresorhus/devtools-detect) and it's also possible to mess with it without knowing it's open. A method that's wildly used is firing the debugger break command many times a second, along with other stuff that makes using the tools nearly impossible (slows the browser down to a halt)
  - bspammer 8y ago
    That script doesn't seem to be able to detect the chrome devtools when they're undocked, so that seems pretty easy to circumvent (who has them docked anyway?). The debugger break thing should be solvable with https://developers.google.com/web/tools/chrome-devtools/javascript/reference#force-resume https://developers.google.com/web/tools/chrome-devtools/java...