Hacker News Reader

in defense of frenck, this is actually a very secure way to perform the task. swiss cheese alignment won't happen because of this

however

it's also a feature transmitting information in a product that bills itself as being offline. imo it's a (minor) privacy violation, not a security violation.

View on HN

> swiss cheese alignment won't happen because of this

This is the problem. You do not know what you do not know. There have already been papers written about the problems with HIBP. You don't have to understand the threat model for it to exist.

Actually, I do :)

The papers written about HIBP, one of which I contributed to, address some actual problems. but this isn’t one of them

It's a trust violation.

Yes, that is different than a security violation. This is a privacy (trust) violation.

Reply on news.ycombinator.com