Hacker News Reader

Comment by auslander | Hacker News Reader

Streisand effect in its best :) I wouldn't trust Troy. He was trying to put passwords checks using third-party APIs, Cloudflare and 1Password into Firefox code.

https://news.ycombinator.com/item?id=17395342

View on HN

Why did you need to post 5 top-level comments to say that?

Because my first one, with 12 posts in it, was flagged. And second one too.

Not password checks, but rather "does my email appear on haveibeenpwnd.com".

The very passwords:

"k-anonymity" model which works like this: when searching HIBP for a password, the client SHA-1 hashes it then ... sends this to the API.

https://www.troyhunt.com/were-baking-have-i-been-pwned-into-...

According to the description in the linked article, only the first 5 characters of the hash of the password are sent to the API (and that API is not publicly available in the first place, apparently, but can only be accessed via Mozilla or 1Password's own APIs).

What exactly appears to be the problem?

The reasoning for this feature is clearly laid out, and the underlying "ethics of running a database breach search service", while controversial, are also something Troy has thought about very carefully:

https://www.troyhunt.com/the-ethics-of-running-a-data-breach...

> What exactly appears to be the problem?

My trusted browser should not send out any sensitive information.

Yeah, but that's not sensitive information.

You'd be surprised ... :)

... yes, I would be surprised if the SHA1 of the first 5 chars of a password was sensitive. If I'm missing something, please share.

This implementation has no value to potential attackers. Anything it could -if it could- help you with, you can already do without it.

Reply on news.ycombinator.com