Hacker News Reader

Comment by starfallg | Hacker News Reader

Basically this, more or less. HIBP was rendered obsolete ever since Chrome had that feature built-in.

Edit: Specified Chrome instead of password managers in general. Chrome doesn't use HIBP as its source.

I wonder how HIBP has been rendered obsolete if many of the password managers rely on its API to do the actual check.

The value of HIBP is not the actual code, I’d assume that’s fairly boring. The value is the database of leaks and the credibility to be contacted when new data dumps show up. None of this can easily be replicated.

The leaks are trivial to compile, and the tech is very basic, anyone with enough scripting skills and alcohol can do it in under a month. The real value of HIBP is the owner's credibility in the security industry when it comes to offering a service that 'sounds like' it requires some trust (it really doesn't because you can use the service with data anonymization features).

The problem is he has been a complete failure on the business side. If he marketed it as 'you can fire 50% of your customer support if you stop account cracking using our service', charge per requests, and provided a bunch of code integrations there's no reason this couldn't be used by thousands of businesses, including top companies which have serious account cracking problems.

The business model wasn't selling the service, but as with many security personalities, buying attention. People in a fairly wide circle know who Troy Hunt is. He can probably get a good honorarium, flight and free dinner for speaking to the Kentucky Association of Banking Compliance Officers or whatever.

It's probably reaching a point where the return on announcing breaches is declining, and the potential value of selling data of questionable origin to a legit entity is very challenging. The dataset gets less valuable every day because anyone can start collecting breaches today, and the value of old breaches goes down -- who cares about an Adobe account leak from 2012?

Chrome's password manager, doesn't use HIBP. Neither does Apple's implementation.

The barrier to collecting leaked dumps and compiling a database from them is not that high. Many of the security outfits and large tech vendors are doing it already.

Mozilla/Firefox uses HIBP. (1) so does gopass. So you're saying that because some browsers use their vendors database, it suddenly becomes obsolete?

> Many of the security outfits and large tech vendors are doing it already.

Certainly, not doing so would be negligent. But that, too, doesn't make HIBP obsolete - there's value in having such a database that's openly queryable via an API and under independent and trusted stewardship.

HIBP also offers features that go beyond what a browser/password manager can do: It offers monitoring for entire domains that you manage. I have all our domains that we're using for email registered at HIBP.

(1) https://blog.mozilla.org/futurereleases/2018/06/25/testing-f...

... the password managers that query HIBP to check passwords?

> HIBP was rendered obsolete ever since Chrome had that feature built-in.

A feature that many developers have to disable because you can't make Chrome ignore certain entries for localhost. For local development I have stuff that spins up a server of, let's say a CMS, and it uses the usual default credential "admin/admin". Yes Chrome, I know that this is an insecure password that has been breached, but this is a freaking development system, leave me alone...

The only way to avoid these messages is to disable the feature globally and that option is hidden deep in the extended settings.

Where do you think the password managers get that data from?

Reply on news.ycombinator.com