Hacker News Reader

Comment by handoflixue | Hacker News Reader

How is a provably anonymous operation a violation of privacy?

I value my privacy quite highly, but I don't mind harmless, anonymous use of my data

Depending on how it's batched, this tells HIBP (and any MITM -- even one that can only see ciphertext) roughly how many unique passwords you use. Knowing the 5-character hash prefix also cuts down brute force attacks by a factor of a million -- though in practice this is only a real issue if you use one of the compromised passwords (there's only a few hundred candidates per prefix), in which case you're kind of screwed already because they're probably in dictionaries anyway.

I don't think these are /critical/ issues and the latter is basically just an argument against the HIBP service, but the point is that a user should opt-in to sharing their data in cases like this so they have a chance to make an informed decision. The k-anonymity design of the HIBP service has a degree of anonymity, it's not "provably anonymous" like homomorphic encryption or similar schemes would be.

Does it actually batch them in an identifying way?

Is there any realistic value to knowing "how many unique passwords you use"? If you already have one of my passwords compromised, you'd presumably try it on the rest of my accounts regardless?

My browser fingerprint leaks, what, thousands of times more information than that - surely fixing applications like Chrome to have sensible privacy-preserving opt-in-only behavior is vastly more important than nagging some obscure open source software about an edge case that can barely be exploited?

By "batching" I was referring to whether they deduplicate requests -- if they do one HTTP request for every password then you get some extra information about how passwords are shared that you would have to infer otherwise.

If you know someone with N logins has N passwords it's a decent indication they use a password manager and so passwords are unlikely to be weak, if they have 1 password it's probably shared elsewhere and weak.

I also wasn't responding to a question asking about practical exploits, I was responding to a question that claimed the k-anonymity model is "provably anonymous" and "harmless". Since it clearly leaks some information it's definitely not the former and one could argue it's not the later though the "harm" is minimal.

> My browser fingerprint leaks, what, thousands of times more information than that - surely fixing applications like Chrome ...

I fail to see how the privacy nightmare of modern browsers is relevant to a discussion on whether opt-out signalling to third-party services is a reasonable stance for an open source project? By that metric no privacy bug is worth reporting because Chrome continues to exist. If only there was a term for this kind of non-sequitur...

If you want to claim something is harmful, you have to actually demonstrate that harm. Otherwise your claim is merely that it could be harmful, which is by default true of basically everything, and thus not a very interesting point.

"Leaks information" is perfectly compatible with "provably anonymous"

You have to prove that the leak is enough to actually de-anonymize someone to disprove anonymity.

I'm not saying it can't be done, but you're jumping ahead and skipping a very important step.

Even sending out a request to a third party server without any input by the user or good reason (which I wouldn’t count this as) should be counted as a privacy violation because HIBP can now infer that network is running HA.

Wait, how? It's not like it's the only app doing this, and I would assume it's not signing it's requests?

By a virtue of the fact that each and every server logs all packets 24/7 nowadays. For example, if you run a port scanner over a million different IP addresses, and one of them happens to be mine, then in my logs there is your IP now.

Yes, but how do you go from "I got pinged by this IP" to "this network is running HA, and not one of a dozen of other tools that tend to ping this IP"?

The claim wasn't that they have the IP address - that's useless on it's own. The claim was that this somehow establishes it as an HA account

The use isn't anonymous, it sends your IP address to a third party, a personally identifying piece of information.

This is fundamental feature of all traffic sent via IP unfortunately.

Okay, but (a) it's a well known, trusted service and (b) yeah, my browser does that every time I visit a site but no one seems to freak out about that. Like... an IP address by itself is useless, and it's being handed to a trusted party anyway...

>my browser does that every time I visit a site

The purpose of a browser is to make network requests. If I use a browser, I am implicitly giving it consent to make the network requests necessary for the web browsing I do.

This implied consent does not cover unnecessary requests, e.g. the adverts Firefox displays on new tabs by default are unacceptable, because I did not consent to them being downloaded. It also does not cover the network requests made by opening the "Extensions and Themes" menu, because merely looking at a configuration menu does not imply consent to make network requests.

But that fact that modern web browsers are a privacy disaster does not excuse bad behavior from other software.

That's not how privacy works. I don't care what you mind or consider harmless, no tool should be scanning the file system for anything without explicit consent and permission.

Making such a behavior opt-out is malicious, intentionally or not. --pwned=false? Give me a fucking break, so you're pwned by default then. Unbelievable what some developers think they can get away with.

Did it scan the file system? Or did users hand over the passwords as part of the application? Because everything else makes it sound like the latter.

The site is called "Have I Been Pwned", thus the cutesy name of the flag...

Perhaps it scans a database and not the file system, but either way, if I see an application gathering passwords and sending remote requests to an unauthorized third party "pwnedpasswords.com" (literally) without my explicit command to do so, then it is acting maliciously by design.

It's a password management system - it's not "gathering" passwords, it is being explicitly given passwords by the user. This is a very important difference! The entire point of the application is that you give it your passwords and it keeps them secure.

The designer felt that "secure" included "is this password already published, online, in a known database breach", which is not an unreasonable interpretation.

The documentation has been clarified. There was a a feature flag. Calling this malicious is just absurd flame-bait.

I understand you're OK with a password managing application making remote requests to a third party without your permission or consent. For me it's unacceptable and unforgivable. We have differing opinions.

My whole point is that this should be "differing opinions" and not "moral condemnation". It's not a mere "difference of opinion" if you consider something unacceptable and unforgivable, or act entitled towards the maintainers of a free, open-source program that doesn't conform to your "opinions."

Home assistant is not a password management system. It's a home automation system. The fact that they added password management features into it does not change what it is. Is your email client a password management system because you enter your password into it?

It wasn't malicious but it wasn't expected.

Reply on news.ycombinator.com