Hacker News Reader

Comment by wyc | Hacker News Reader

Yes, I did. Particularly this part:

> If you visit a site on Have I Been Pwned's naughty list, it will throw a flag stating, "You visited hacked site ashleymadison.com."

This does more than just tell users if their credentials have been compromised. That copy is likely to affect traffic in a manner similar to invalid HTTPS certs.

Wouldn't you agree that some degree of subjectivity lies within the specific partnership with Have I Been Pwned and its submissions? Popular does not mean just.

A lot of this is contingent on how the user interface and data are presented in the program. That "there is nothing subjective about this" may be true for only a facet of the whole issue. No doubt, there are potential benefits for everyone here, but some of the worst outcomes have resulted from the best intentions.

View on HN

Can you clarify how HIBP could be perceived as either unjust or subjective?

To the extent data breaches are only committed by external bad guys it’s fine. If hacking a competitor causes a user visible flag, there is now incentive.

How is a breach from a competitor, who is doing it for financial motives, different from an "external bad guy" who is doing it for financial motives?

It's a little different because the competitor does not want the digital assets being hacked, but rather just wants the hack to be on record.

Hopefully this will also be an incentive for website owners to let developers spend time on security to avoid getting hacked.

That could happen from any measure that makes people care about breaches.

But I want people to care about breaches.

I think it's worth the risk.

Here are a few reasons that I hope you find somewhat convincing:

- Single point of failure. It's ran by one person who can be bribed or manipulated. I've never met Troy Hunt, and from what I can tell he looks like a great upstanding guy[1], but $5 wrenches will work on my kneecaps too.

- What's the process for reporting and publishing? Appeals? There's no transparency here, aside from a list of 5 one-sentence steps in the FAQ[2]. How do we decide what data are "sensitive"? My guess is that there's not too much review.

- As hinted above, with a publicly available shame list, there would exist new incentives to get competitors and enemies on the list. How does this play with a loosely documented review + publish process? With a user interface that might oversimplify the issue?

Please don't misunderstand these points as hostility. I really really like Have I Been Pwned and think it's amazing what Troy is doing. It's just that if we're building new web infrastructure, it's important that we get it right. I think where we can agree is that web users deserve more control over their data by default and shouldn't have to learn how to install and use several fringe programs to do so.

[1] https://haveibeenpwned.com/About

[2] https://haveibeenpwned.com/FAQs

Troy Hunt works for Microsoft. What is to say the employer won’t influence the list for personal gain. E.g if Azure and Aws both got hacked, high chances of AWS appearing in the list but not Azure.

I think he is an MVP which is no relation to being a member of staff. He advocates for their products from what I can see, probably because he was a .net dev.

Reply on news.ycombinator.com