Hacker News Reader

Comment by deanclatworthy | Hacker News Reader

Troy does talk a little bit about the data here, but the codebase is not entirely useful without the data. I don't doubt it can be improved from Troy's one-man-efforts in that area, but the real value of haveibeenpwnd is in the data - and the code is useless without a huge trove of breach data - which I guess is never going to be open.

View on HN

There’s no perfect solution here: publish the raw data, and people who haven’t changed their passwords get cracked, or publish hashed (in some way) passwords, and people will crack the passwords themselves. (That said, I guess most crackers will just get the data straight from the source, but still.)

He does publish the passwords hashed, with the number of times each password was leaked (without salt and the weak sha1).

Incorporate a non profit and have it own the data and run the service? No different than Let's Encrypt.

It is trivial to find (most) of the datasets HIBP uses

Breach data is, by definition, open. You just have to dig a little, and sometimes pay criminals.

Troy got it; so can you.

That implies the same data still exists, which I don't think is true for many breaches.

I think it’s safe to assume that all breached info is archived and available forever.

Both as a curiosity, a research tool, and a crime tool.

As a hobbyist, I used to have a folder of breached data (ashley Madison was really fun). And if you add in groups like /r/datahoarders, the data will probably be kept someone.

The dataset could be reconstructed if needed.

Yeah make the data available so that we can have AWS Elastic Pwned, and HIBP to be eclipsed by it

Reply on news.ycombinator.com