Hacker News Reader

Comment by netman21 | Hacker News Reader

I don't get what Troy Hunt has done to his tool. You used to be able to type in an email address and learn all the times your credentials have been in a leak/breach. Now he wants you to enter your password. What security minded person would reveal their password to a site like this? It would be trivial to associate your password to your IP address.

View on HN

You're getting two different tools mixed up -- "Have I Been Pwned?" and "Pwned Passwords."

Have I Been Pwned is the tool where you search your email, and it displays breaches.

Pwned Passwords is an API (there is a front-end but that's not the usecase) where you send a partial hash of a password to the API, and it returns a list of partial hashes that match, and the implementation from there sees if any of them match the full hash. It's used by quite a few online services to ensure users don't use weak passwords, as if it's shown up in multiple data breaches, they might not let you set it as your password.

Good article explaining how they use k-anonymity here:

https://blog.cloudflare.com/validating-leaked-passwords-with...

Thanks! Now I get it.

You're confusing pwned passwords wtih https://haveibeenpwned.com/

As for pwned passwords, it doesn't send the password. The way it works is that you submit the first 5 characters of a hash, and get back a list of all hashes.

You then locally compare the complete hash to see if it is there.

This is a separate tool, HIBP is still up and running.

umm, that feature is still there. This is for checking if the password you are using has been in any breach or not.

Also, the password doesn't go to the server but its hash goes.

Lastsly, he had to make the free API paid because people were DDOSing it

I don't see this. I go to https://haveibeenpwned.com and it works just as before (email address only). I am slightly bothered that I can enter anyone's email address and learn something about them tho.

Some breaches are marked as "sensitive". HIBP won't tell you if an email is in one of the sensitive breaches unless you prove ownership of the email address by clicking on a verification link.

You can learn even more about them by looking up their address in one of these (widely available) data dumps.

Is this not the tool (in some form) that's integrated with 1password? That one is indeed designed to check password hashes for matches in leaks.

Reply on news.ycombinator.com