3 ms·

Have I been Pwned goes open source

• tuxie_ 5y ago
  > I had no idea how to manage an open-source project, establish the licensing model, coordinate where the community invests effort, take contributions, redesign the release process, and all sorts of other things I'm sure I haven't even thought of yet. It's interesting how I (having worked on FOSS for a decade) took for granted all these things, assuming they'd be obvious to anyone. Good work there, HIBP team!
  • naikrovek 5y ago
    > HIBP team it's just one guy. that makes all of this even more impressive to me.
• anm89 5y ago
  Dumb question. Why would it be secure to type your password into a site to find out if it has been pwned if that site isn't open source and auditable. Hasn't that been a terrible idea since day one? Or am I failimg to understand something about how they architected this that makes it unquestionably secure to blast passwords out to some third party website?
  • X-Cubed 5y ago
    You can inspect the traffic to the API, but it only sends a hash prefix and returns a list of all matching hashes (k-anonymity). The hard work is done in the client, not the back-end. https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v... https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with...