Hacker News Reader

OK, calm down for a minute. You need to read how k-Anonymity works before you continue to comment on this:

https://blog.cloudflare.com/validating-leaked-passwords-with...

It isn't sending a plaintext password, not even a full hash of the password. This is entirely fine..

> This is entirely fine..

... until it doesn't. Any update on did this HIBP 'feature' made it into Firefox?

You’ve yet to tell me when it’s not fine. Can you please provide some citations or technical reasonings besides just putting forward unsubstantiated claims? Below you've told jgahramc you refuse to read how it works, then you probably shouldn't make claims on this.

Bugs can happen.

One of the first scenarios that comes to mind - some implementation queries API for every key press. Suddenly you are sending your password out.

I guess time will tell, but human-generated passwords have proven their ineffectiveness anyway.

That’s still not a problem with Troy/Cloudflare/k-Anonymity. Bugs happen, sure, but I’d hope your password manager that stores all of your passwords, reliably, has unit tests to prevent that kind of failure scenario.

Reply on news.ycombinator.com