5 ms·
Troy does talk a little bit about the data here, but the codebase is not entirely useful without the data. I don't doubt it can be improved from Troy's one-man-
by deanclatworthy 6y ago
Troy does talk a little bit about the data here, but the codebase is not entirely useful without the data. I don't doubt it can be improved from Troy's one-man-efforts in that area, but the real value of haveibeenpwnd is in the data - and the code is useless without a huge trove of breach data - which I guess is never going to be open.
- sneak 6y agoBreach data is, by definition, open. You just have to dig a little, and sometimes pay criminals. Troy got it; so can you.
- Craighead 6y agoThat implies the same data still exists, which I don't think is true for many breaches.
- prepend 6y agoI think it’s safe to assume that all breached info is archived and available forever. Both as a curiosity, a research tool, and a crime tool. As a hobbyist, I used to have a folder of breached data (ashley Madison was really fun). And if you add in groups like /r/datahoarders, the data will probably be kept someone. The dataset could be reconstructed if needed.
- anaganisk 6y agoYeah make the data available so that we can have AWS Elastic Pwned, and HIBP to be eclipsed by it
- 1f60c 6y agoThere’s no perfect solution here: publish the raw data, and people who haven’t changed their passwords get cracked, or publish hashed (in some way) passwords, and people will crack the passwords themselves. (That said, I guess most crackers will just get the data straight from the source, but still.)
- speedgoose 6y agoHe does publish the passwords hashed, with the number of times each password was leaked (without salt and the weak sha1).
- toomuchtodo 6y agoIncorporate a non profit and have it own the data and run the service? No different than Let's Encrypt.
- nnt38 6y agoIt is trivial to find (most) of the datasets HIBP uses