4 ms·
Show HN: "Have I Been Pwned” with homomorphic encryption
- blintz 4y agoHey, I made this! Happy to answer any questions.
- hn92726819 4y agoDoes the server have to multiply the whole 8G block by the encrypted query? If not, wouldn't the server know which block the query was for? Why return a full row? Wouldn't that leak the hashes of an entire row to every client? Why not set the encrypted query to return just if the password is there or not?
- blintz 4y agoYes, the server multiplies the query by the entire 8 GB every time. It’s not as slow as it sounds :-) … it’s basically limited by memory bandwidth. Yeah, we do return the full row. It does leak the hashes, but these are already public (you can directly download them from the Have I Been Pwned website). Under the hood, we don’t actually send the full hashes back; we can get away with just sending back fewer bits (enough to minimize the chance of a false positive).
- Spoiled_toast 4y agoSurprisingly “opensesame” is a safe password. Try it out