Hacker News Reader

Parent Full thread

sugerman

He recently shared Pwned Passwords which lets you check if your password is in the breached data.

1Password then did a POC integration into their service so you can test if your password shows up in HIBP data.

https://blog.agilebits.com/2018/02/22/finding-pwned-password...

View on HN

Right but that's not so useful for security researches. Analysis of the actual passwords would be more useful.

His reasons:

https://www.troyhunt.com/no-i-cannot-share-data-breaches-wit...

https://www.troyhunt.com/here-are-all-the-reasons-i-dont-mak...

Indeed. I guess the best practical argument is sharing them securely is hard. Which is very true. However if it's not possible for two security researchers to exchange data then what hope is there for the rest of us?

I get he doesn't want to do that and that is his prerogative. However, it does feel like we're so scared of things falling into the wrong hands that we hobble our ability to defend against hacks in the first place.

I would imagine if there are any security researchers he trusts sharing the data with, they wouldn't need to email him out of the blue for it, nor need to discuss it with the rest of us.

But no, there is likely no hope, lol

Reply on news.ycombinator.com