5 ms·

I don't get what Troy Hunt has done to his tool. You used to be able to type in an email address and learn all the times your credentials have been in a leak/br

I don't get what Troy Hunt has done to his tool. You used to be able to type in an email address and learn all the times your credentials have been in a leak/breach. Now he wants you to enter your password. What security minded person would reveal their password to a site like this? It would be trivial to associate your password to your IP address.

fenwick67 6y ago
This is a separate tool, HIBP is still up and running.
herodotus 6y ago
I don't see this. I go to https://haveibeenpwned.com https://haveibeenpwned.com and it works just as before (email address only). I am slightly bothered that I can enter anyone's email address and learn something about them tho.
- c22 6y ago
  You can learn even more about them by looking up their address in one of these (widely available) data dumps.
- Flimm 6y ago
  Some breaches are marked as "sensitive". HIBP won't tell you if an email is in one of the sensitive breaches unless you prove ownership of the email address by clicking on a verification link.
giantDinosaur 6y ago
Is this not the tool (in some form) that's integrated with 1password? That one is indeed designed to check password hashes for matches in leaks.
navanchauhan 6y ago
umm, that feature is still there. This is for checking if the password you are using has been in any breach or not. Also, the password doesn't go to the server but its hash goes. Lastsly, he had to make the free API paid because people were DDOSing it
Yanu-3452 6y ago
You're confusing pwned passwords wtih https://haveibeenpwned.com/ https://haveibeenpwned.com/ As for pwned passwords, it doesn't send the password. The way it works is that you submit the first 5 characters of a hash, and get back a list of all hashes. You then locally compare the complete hash to see if it is there.
laken 6y ago
You're getting two different tools mixed up -- "Have I Been Pwned?" and "Pwned Passwords." Have I Been Pwned is the tool where you search your email, and it displays breaches. Pwned Passwords is an API (there is a front-end but that's not the usecase) where you send a partial hash of a password to the API, and it returns a list of partial hashes that match, and the implementation from there sees if any of them match the full hash. It's used by quite a few online services to ensure users don't use weak passwords, as if it's shown up in multiple data breaches, they might not let you set it as your password.
- fuhrysteve 6y ago
  Good article explaining how they use k-anonymity here: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with...
- netman21 6y ago
  Thanks! Now I get it.

fenwick67 6y ago

This is a separate tool, HIBP is still up and running.

herodotus 6y ago

I don't see this. I go to https://haveibeenpwned.com https://haveibeenpwned.com and it works just as before (email address only). I am slightly bothered that I can enter anyone's email address and learn something about them tho.

c22 6y ago
You can learn even more about them by looking up their address in one of these (widely available) data dumps.
Flimm 6y ago
Some breaches are marked as "sensitive". HIBP won't tell you if an email is in one of the sensitive breaches unless you prove ownership of the email address by clicking on a verification link.

giantDinosaur 6y ago

Is this not the tool (in some form) that's integrated with 1password? That one is indeed designed to check password hashes for matches in leaks.

navanchauhan 6y ago

umm, that feature is still there. This is for checking if the password you are using has been in any breach or not. Also, the password doesn't go to the server but its hash goes. Lastsly, he had to make the free API paid because people were DDOSing it

Yanu-3452 6y ago

You're confusing pwned passwords wtih https://haveibeenpwned.com/ https://haveibeenpwned.com/ As for pwned passwords, it doesn't send the password. The way it works is that you submit the first 5 characters of a hash, and get back a list of all hashes. You then locally compare the complete hash to see if it is there.

laken 6y ago

You're getting two different tools mixed up -- "Have I Been Pwned?" and "Pwned Passwords." Have I Been Pwned is the tool where you search your email, and it displays breaches. Pwned Passwords is an API (there is a front-end but that's not the usecase) where you send a partial hash of a password to the API, and it returns a list of partial hashes that match, and the implementation from there sees if any of them match the full hash. It's used by quite a few online services to ensure users don't use weak passwords, as if it's shown up in multiple data breaches, they might not let you set it as your password.

fuhrysteve 6y ago
Good article explaining how they use k-anonymity here: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with...
netman21 6y ago
Thanks! Now I get it.