Hacker News Reader

Even sending out a request to a third party server without any input by the user or good reason (which I wouldn’t count this as) should be counted as a privacy violation because HIBP can now infer that network is running HA.

View on HN

Wait, how? It's not like it's the only app doing this, and I would assume it's not signing it's requests?

By a virtue of the fact that each and every server logs all packets 24/7 nowadays. For example, if you run a port scanner over a million different IP addresses, and one of them happens to be mine, then in my logs there is your IP now.

Yes, but how do you go from "I got pinged by this IP" to "this network is running HA, and not one of a dozen of other tools that tend to ping this IP"?

The claim wasn't that they have the IP address - that's useless on it's own. The claim was that this somehow establishes it as an HA account

Reply on news.ycombinator.com