4 ms·
Dumb question. Why would it be secure to type your password into a site to find out if it has been pwned if that site isn't open source and auditable. Hasn't t
by anm89 5y ago
Dumb question. Why would it be secure to type your password into a site to find out if it has been pwned if that site isn't open source and auditable.
Hasn't that been a terrible idea since day one? Or am I failimg to understand something about how they architected this that makes it unquestionably secure to blast passwords out to some third party website?
- X-Cubed 5y agoYou can inspect the traffic to the API, but it only sends a hash prefix and returns a list of all matching hashes (k-anonymity). The hard work is done in the client, not the back-end. https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v... https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/ https://blog.cloudflare.com/validating-leaked-passwords-with...