4 ms·
Reading through the article and the other sources linked, this seems to be a different dataset and implementation than the "Have I been pwned" dataset that Fire
by aquova 7y ago
Reading through the article and the other sources linked, this seems to be a different dataset and implementation than the "Have I been pwned" dataset that Firefox and other password managers reference. However, I don't see any information about where their data comes from, only information about how the feature/extension works to not leak your password during verification.
- tialaramex 7y agoTo be fair, if you have money (which Google does) you can buy a LOT of this data, every single day, forever. There are at least two distinct outfits which pay grey hats to steal data from black hats who in turn obtained it typically through cheesy script kiddie attacks on web sites or phishing. If you give them not very much money they'll "monitor" their stream of supposedly fresh stolen data (a lot of it isn't fresh because crooks are also often liars) for specific data items you tell them about. This is a bad deal, but apparently some pretty big US companies pay for that service. It's fine though because everybody reading this has unique strong passwords for every account right? Right? If you give them a LOT of money (or if you were say one of my former employers and you owned the company that does this outright) you just get the raw data. As like UTF-16 XML or CSV files with different types of quoting on each line, or whatever other crazy and inadequately documented nonsense came to mind for each such type of file delivered.
- dannyw 7y agoAt Google’s scale, I HOPE they have an internal team dedicated to building out their own HIBP, and at the very least scanning employee credentials on a near real-time basis.