7 ms·

Probably worth noting that Have I Been Pwned is now up for sale: https://www.troyhunt.com/project-svalbard-the-future-of-have-i-been-pwned/ https://www.troyhunt

Probably worth noting that Have I Been Pwned is now up for sale: https://www.troyhunt.com/project-svalbard-the-future-of-have-i-been-pwned/ https://www.troyhunt.com/project-svalbard-the-future-of-have... I've always been a huge fan of the project (and Troy) and understand that it's gotten to a point where he can't keep running it as a spare-time project, but I'm still not very happy about seeing it being shopped around. I can't see how this type of service needing to find a way to become a business will be a good thing overall, especially when it keeps getting integrated into other programs and services like this. Troy pledges that nothing will change, but every company getting acquired does that, and then things change anyway. The best result would probably be something like Mozilla buying it and/or paying Troy to just keep doing what he's doing.

denzil_correa 7y ago
> The best result would probably be something like Mozilla buying it and/or paying Troy to just keep doing what he's doing. Mozilla could very well be one of the potential candidates for HIBP ownership.
- NeutronStar 7y ago
  Sure, but until then, nope.
- bradknowles 7y ago
  Troy has spoken about that. They are a known candidate, but they fall further down the list on some of his criteria than he would like. However, he doesn't provide any further details on this issue. Meanwhile, he continues to look for other candidates.
Mirioron 7y ago
I would even say that a project like this should be run by the government(s). I get that foreign politics would wreck havoc there, but governments have to deal with data breaches anyway.
- jammygit 7y ago
  The government seems like the party most likely to, and most able to, abuse being in control of a trusted security resource. Would you trust the API if it was operated by the USA (NSA), Russia, China, Australia, or the UK?
mike-cardwell 7y ago
I was a fan of the project. But when it went up for sale, I contacted him to ask for my details to be removed from his db (re the auto-notification stuff), and didn't get any response. I'm no longer a fan. Guess I shouldn't have trusted him with my personal information.
prepend 7y ago
This is why I never check passwords against haveibeenpwned. The idea of sending your passwords to a third party is pretty crazy. Even when I knew the owner and trusted him, there’s no way I’d know everyone with access. And now the site could be sold to someone like Google and God knows what they would do with all that traffic. I used to download the whole file and check locally, but it’s too much of a pain to do consistently.
- EGreg 7y ago
  Wait, WHAT? Troy’s site asks you to send passwords? Not just login identifiers like an email or username? In that case, you should AT LEAST be sending a hash of a password, a very key-strengthened hash (like sha2 done 1000 times) and on his side Troy can see if it matches anything.
  - DjangoReinhardt 7y ago
    Yeah, that's what HIBP does. See here: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity https://www.troyhunt.com/ive-just-launched-pwned-passwords-v... I really feel Troy has handled HIBP very, very carefully, honestly, and with the utmost transparency so far. He seems to have put in a lot of thought into everything - whether it is rolling out a feature or planning the future of HIBP.
    - DuskStar 7y ago
      To clarify for the GP: HIBP sends the first handful of characters of the password hash to the server, not the password itself or even the full hash. The server then returns all of the hashes matching that prefix, and the remainder of the comparison is done client side.
- tomschlick 7y ago
  > The idea of sending your passwords to a third party is pretty crazy. Thats not how it works. You hash your password first and then take the first 6 chars of the hash to query the api. The api then returns all of the hashes that begin with those 6 chars and you scan the results for your full hash. https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with...

denzil_correa 7y ago

> The best result would probably be something like Mozilla buying it and/or paying Troy to just keep doing what he's doing. Mozilla could very well be one of the potential candidates for HIBP ownership.

NeutronStar 7y ago
Sure, but until then, nope.
bradknowles 7y ago
Troy has spoken about that. They are a known candidate, but they fall further down the list on some of his criteria than he would like. However, he doesn't provide any further details on this issue. Meanwhile, he continues to look for other candidates.

Mirioron 7y ago

I would even say that a project like this should be run by the government(s). I get that foreign politics would wreck havoc there, but governments have to deal with data breaches anyway.

jammygit 7y ago
The government seems like the party most likely to, and most able to, abuse being in control of a trusted security resource. Would you trust the API if it was operated by the USA (NSA), Russia, China, Australia, or the UK?

mike-cardwell 7y ago

I was a fan of the project. But when it went up for sale, I contacted him to ask for my details to be removed from his db (re the auto-notification stuff), and didn't get any response. I'm no longer a fan. Guess I shouldn't have trusted him with my personal information.

prepend 7y ago

This is why I never check passwords against haveibeenpwned. The idea of sending your passwords to a third party is pretty crazy. Even when I knew the owner and trusted him, there’s no way I’d know everyone with access. And now the site could be sold to someone like Google and God knows what they would do with all that traffic. I used to download the whole file and check locally, but it’s too much of a pain to do consistently.

EGreg 7y ago
Wait, WHAT? Troy’s site asks you to send passwords? Not just login identifiers like an email or username? In that case, you should AT LEAST be sending a hash of a password, a very key-strengthened hash (like sha2 done 1000 times) and on his side Troy can see if it matches anything.
- DjangoReinhardt 7y ago
  Yeah, that's what HIBP does. See here: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity https://www.troyhunt.com/ive-just-launched-pwned-passwords-v... I really feel Troy has handled HIBP very, very carefully, honestly, and with the utmost transparency so far. He seems to have put in a lot of thought into everything - whether it is rolling out a feature or planning the future of HIBP.
  - DuskStar 7y ago
    To clarify for the GP: HIBP sends the first handful of characters of the password hash to the server, not the password itself or even the full hash. The server then returns all of the hashes matching that prefix, and the remainder of the comparison is done client side.
tomschlick 7y ago
> The idea of sending your passwords to a third party is pretty crazy. Thats not how it works. You hash your password first and then take the first 6 chars of the hash to query the api. The api then returns all of the hashes that begin with those 6 chars and you scan the results for your full hash. https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with...