Hacker News Reader

Comment by auslander | Hacker News Reader

I don't trust Troy anymore. He pushed into the Firefox 1Password and Cloudflare based password checks. "Praises for Troy, Troy praises 1Password and Cloudflare..."

https://news.ycombinator.com/item?id=17395342

What happened to this 'integration' effort, btw?

View on HN

Why would that result in loss of respect/trust? k-anonymity works great and is perfect for application into password managers and on-registration password security checks.

The combination of 'Baking HIBP into Firefox' and 'Cloudflare did some great work' and 'sends this to the API' just sounds bad.

We are talking passwords here, for god's sake, I want nothing be sent nowhere, let my browser and me alone.

OK, calm down for a minute. You need to read how k-Anonymity works before you continue to comment on this:

https://blog.cloudflare.com/validating-leaked-passwords-with...

It isn't sending a plaintext password, not even a full hash of the password. This is entirely fine..

> This is entirely fine..

... until it doesn't. Any update on did this HIBP 'feature' made it into Firefox?

You’ve yet to tell me when it’s not fine. Can you please provide some citations or technical reasonings besides just putting forward unsubstantiated claims? Below you've told jgahramc you refuse to read how it works, then you probably shouldn't make claims on this.

Bugs can happen.

One of the first scenarios that comes to mind - some implementation queries API for every key press. Suddenly you are sending your password out.

I guess time will tell, but human-generated passwords have proven their ineffectiveness anyway.

That’s still not a problem with Troy/Cloudflare/k-Anonymity. Bugs happen, sure, but I’d hope your password manager that stores all of your passwords, reliably, has unit tests to prevent that kind of failure scenario.

You are arguing with yourself and haven't looked into how Troy's API service works. Worth reading: https://blog.cloudflare.com/validating-leaked-passwords-with...

Point is, I trust Firefox, and it may lose my trust when it makes third-party API calls involving my passwords by default.

Should I read how Troy's API service works? No.

I was very uncomfortable with Pwned Passwords until I read how it works. And even then, the true comfort blanket for me was writing a script that talked to it myself, so I could see exactly what info I was sending, and what info I was receiving back.

I'm now entirely comfortable with this product/service. Read how it works.

Should I read how Troy's API service works? No.

Yes. Until you do that, you are arguing in utter ignorance - and you’re wrong, to boot.

Reply on news.ycombinator.com