3 ms·

I wonder how HIBP has been rendered obsolete if many of the password managers rely on its API to do the actual check. The value of HIBP is not the actual code,

I wonder how HIBP has been rendered obsolete if many of the password managers rely on its API to do the actual check. The value of HIBP is not the actual code, I’d assume that’s fairly boring. The value is the database of leaks and the credibility to be contacted when new data dumps show up. None of this can easily be replicated.

deleted 6y ago
[deleted]
starfallg 6y ago
Chrome's password manager, doesn't use HIBP. Neither does Apple's implementation. The barrier to collecting leaked dumps and compiling a database from them is not that high. Many of the security outfits and large tech vendors are doing it already.
- Xylakant 6y ago
  Mozilla/Firefox uses HIBP. (1) so does gopass. So you're saying that because some browsers use their vendors database, it suddenly becomes obsolete? > Many of the security outfits and large tech vendors are doing it already. Certainly, not doing so would be negligent. But that, too, doesn't make HIBP obsolete - there's value in having such a database that's openly queryable via an API and under independent and trusted stewardship. HIBP also offers features that go beyond what a browser/password manager can do: It offers monitoring for entire domains that you manage. I have all our domains that we're using for email registered at HIBP. (1) https://blog.mozilla.org/futurereleases/2018/06/25/testing-firefox-monitor-a-new-security-tool/ https://blog.mozilla.org/futurereleases/2018/06/25/testing-f...
tootahe45 6y ago
The leaks are trivial to compile, and the tech is very basic, anyone with enough scripting skills and alcohol can do it in under a month. The real value of HIBP is the owner's credibility in the security industry when it comes to offering a service that 'sounds like' it requires some trust (it really doesn't because you can use the service with data anonymization features). The problem is he has been a complete failure on the business side. If he marketed it as 'you can fire 50% of your customer support if you stop account cracking using our service', charge per requests, and provided a bunch of code integrations there's no reason this couldn't be used by thousands of businesses, including top companies which have serious account cracking problems.
- Spooky23 6y ago
  The business model wasn't selling the service, but as with many security personalities, buying attention. People in a fairly wide circle know who Troy Hunt is. He can probably get a good honorarium, flight and free dinner for speaking to the Kentucky Association of Banking Compliance Officers or whatever. It's probably reaching a point where the return on announcing breaches is declining, and the potential value of selling data of questionable origin to a legit entity is very challenging. The dataset gets less valuable every day because anyone can start collecting breaches today, and the value of old breaches goes down -- who cares about an Adobe account leak from 2012?

deleted 6y ago

[deleted]

starfallg 6y ago

Chrome's password manager, doesn't use HIBP. Neither does Apple's implementation. The barrier to collecting leaked dumps and compiling a database from them is not that high. Many of the security outfits and large tech vendors are doing it already.

Xylakant 6y ago
Mozilla/Firefox uses HIBP. (1) so does gopass. So you're saying that because some browsers use their vendors database, it suddenly becomes obsolete? > Many of the security outfits and large tech vendors are doing it already. Certainly, not doing so would be negligent. But that, too, doesn't make HIBP obsolete - there's value in having such a database that's openly queryable via an API and under independent and trusted stewardship. HIBP also offers features that go beyond what a browser/password manager can do: It offers monitoring for entire domains that you manage. I have all our domains that we're using for email registered at HIBP. (1) https://blog.mozilla.org/futurereleases/2018/06/25/testing-firefox-monitor-a-new-security-tool/ https://blog.mozilla.org/futurereleases/2018/06/25/testing-f...

tootahe45 6y ago

The leaks are trivial to compile, and the tech is very basic, anyone with enough scripting skills and alcohol can do it in under a month. The real value of HIBP is the owner's credibility in the security industry when it comes to offering a service that 'sounds like' it requires some trust (it really doesn't because you can use the service with data anonymization features). The problem is he has been a complete failure on the business side. If he marketed it as 'you can fire 50% of your customer support if you stop account cracking using our service', charge per requests, and provided a bunch of code integrations there's no reason this couldn't be used by thousands of businesses, including top companies which have serious account cracking problems.

Spooky23 6y ago
The business model wasn't selling the service, but as with many security personalities, buying attention. People in a fairly wide circle know who Troy Hunt is. He can probably get a good honorarium, flight and free dinner for speaking to the Kentucky Association of Banking Compliance Officers or whatever. It's probably reaching a point where the return on announcing breaches is declining, and the potential value of selling data of questionable origin to a legit entity is very challenging. The dataset gets less valuable every day because anyone can start collecting breaches today, and the value of old breaches goes down -- who cares about an Adobe account leak from 2012?