Hacker News Reader

Comment by Rygian | Hacker News Reader

I wouldn't be surprised if that integration is outright illegal in EU due to GDPR, thus putting HIBP in trouble for ingesting PII without any legal legitimacy.

And the first reply being "It is not an invasion of privacy" just shows incompetence on privacy topics. It is never a valid answer.

Which is really concerning, for the lead developer of a home automation system that "fights for the fundamental principle of privacy" as per their mission statement.

View on HN

  It is not an invasion of privacy

this rubbed me the wrong way.

absolutely no one but me gets to decide what is an invasion of my privacy.

What PII do you think is being sent to HIBP?

The user's IP address.

It's certainly an overstep, but just the hash they're sending wouldn't be PII.

The hash itself is irrelevant.

The question is what PII does HIBP collect on submission (eg IP address), and with whose consent, and for which purposes?

All that should be explained in excruciating detail in the ticket and in the documentation, to begin with.

I am curious thought that how it would be illegal according to GDPR. They are hashed after all, and the same hash is not used for authentication.

Undoing personal information for a purpose different than the purpose for which it was collected.

Reply on news.ycombinator.com