Hacker News Reader

I don't agree with 1.

This "But Google's Password Checkup doesn't just use public sources" is infering that Google's db is bigger and better. You don't know and this is example of magic lotion marketing.

"Our magic lotion for hair grow is muuuuch better, as it have secret formula".

Actually I suspect that Troy's db as for now is better/bigger.

View on HN

See my other comment. Commercial outfits sell this data on a daily volume basis. Remember it has been (though admittedly not for over a year) literally my job to process the piles of new stolen password data or rather write and oversee programs which did that processing.

Didn't you ever wonder when you see viable SQL injections and other attacks announced so frequently why Troy's data set is so small? Troy is taking the ethical high ground by not buying data. So his data is the tip of the iceberg.

Reply on news.ycombinator.com