Pwned passwords, open source in the .NET foundation and working with the FBI

Yea, I feel like there should be some kind of internet nobel prize and that he should be one of the few to win it. He's definitely a badass.

Yeah love the guy, saved me a few times !

"Incorporated by Microsoft" feels like an important detail to me.

AFAIR the reason this database is stored as SHA-1 hashes is because that's what a large amount of the original data dumps contained. Moving to a harder hash would have required cracking all of them first and wouldn't do much more to ensure the database can't be directly used as a password list for attacks.

I would be willing to bet most intelligent FBI agents have their own stash of data breaches regardless of what agency policy is. Data breaches are truly invaluable in online investigations.

It's written in the blog that fbi is only providing breach datasets not getting them. Through every dataset in HIBP is public already

Haveibeenpwned gets their lists in the same manner anyone else can. FBI already has those lists, probably faster than haveibeenpwned does.

I hazard it depends on the jurisdiction - one thing I remember from my vague parsing of Australia's cyber crime laws (IANAL etc) is that possession of these lists/hacking tools was only criminal where there was an intent to use them for another criminal act (Crimes Act 478.3, probably superseded [1])

[1]: https://www.legislation.gov.au/Details/C2004A00937

Not a lawyer, but my guess would be that whether it is legal or not depends on what (if anything) you intend to do with the information. This is based mainly on perusal of this page summarizing a bunch of state identity theft statutes: https://www.ncsl.org/research/financial-services-and-commerc...

Of the ones with details listed it seems most of them require intent to defraud or something similar in addition to possession of personal information. I think paying for the info could also be problematic, there are a few trafficking laws in that list.

In a similar vein, possession of the info with the intent to use it to hack into something would probably run afoul of the CFAA or other anti-hacking laws.

If you collect that info with the intent to submit it to haveibeenpwned I think you would probably be fine.

If you collect that info just for fun, but don't do anything with it, I suspect that's legal, but probably not well-advised, as I suspect cops/prosecutors/jurors would have trouble believing someone did that for fun, and would interpret it as evidence that you were up to something nefarious.

I don't think the stolen property angle is an issue. Digital information can't really be stolen: usually the problem is you've committed a copyright violation. In the US at least I doubt user names and passwords would qualify for copyright protection. (Generally, collections of facts do not qualify.)

I imagine the FBI strongly considers scale and intent. Troy Hunt is very obviously not reselling accounts, for example.

Though keep in mind that the FBI can go after whoever they want, sometimes without reason at all.

Troy Hunt has blogged a few times about the legitimacy of his service, and it's clearly been a carefully walked path to where it is today.

I think ultimately it comes down to the fact that he's not redistributing the lists of emails, and he doesn't retain pairs of (email + password hash). He designed the site to provide two useful queries ("what breaches included my email" and "has this password been seen in any breaches you processed"), which strike a responsible balance between disclosure and privacy.

Moreover, he has written about his intentions and acted with a fair deal of transparency, which is a strong contrast to some of the shady behavior you'll see from people dancing in the gray areas of the law.

That was probably a stepping stone to partnering with other organizations, which has snowballed into having the cooperation of the FBI, as well as the endorsement of multiple countries' governments.

I suspect its not that the fbi has ntlm/sha1 hashes as their base data set, but that they dont want to give out the actual passwords and settled on these two hashes instead. I think HIBP was already giving out their dataset in this format.

Fwiw, sha1, 256 or even md5 have similar levels of security when it comes to password hashing. The security properties you want for password hashing are very different than normal hashing.

In what sense do you consider SHA-256 superior to SHA-1?

If you're looking for preimage resistance, unless your passwords contain more than 128 bits of entropy, I suspect bruit forcing your password is still faster than a preimage attack on SHA-1, and will probably remain so for at least a decade. Collision attacks aren't useful for passwords (attacker chooses two passwords such that they have the same hash... I can't imagine a threat model under which this is useful to the attacker if that hash doesn't match any target's password hash. Maybe there is such a threat model, but it has to be a very outside-the-box attack.)

If you're worried about effort needed to bruit-force the password, use Argon2 or another memory-hard password hash/KDF.

I think this is a good partnership. One of the goals of open source software foundations is to eliminate risks due to dependency on a small developer team. In this case, HIBP is a fantastic resource being maintained, and paid for, by one developer. That's not good for the maintainer, it's not good for the community, and it's risky to the community. If the sole developer wins a spot on the next flight to Mars or time travels to A.D. 802,701, the code becomes unmaintained and the site hosting payment expires. Software foundations governed by rotating teams and aren't dependant on a single individual. This is an example of something that's relatively low investment for an established software foundation - some legal fees and discounted cloud hosting from a sponsor - and benefits the whole community.

Change your password, change the password of any other site where you use a variation of that password, and enable 2FA on all your accounts. Use a password manager and change your passwords to longer randomly-generated ones over time (most password managers make this easy).

2FA is more than adequate on its own in a lot of cases: Attackers tend to go for low lying fruit.

Also, how worried you need to be depends on what you use the account for... People go off the deep end about securing every single account like it's Fort Knox, but you need to consider what is at risk if a given account is compromised, and what damage could be done with it.

The only thing I'd add to the other comment (by babelfish) is: I'm not sure from your description whether your email account itself was compromised or merely an account on some site that is connected to your email (for example, a hacker news account which you used that email address to sign up with).

If the email account itself was compromised, then you should also check any account that you signed up for using that email address, to make sure that you still have access (because if someone had access to your email, they could have used it to reset the password on those other sites).

Obviously look out for targeted phishing from people who know that you have a registration with a particular site. But if you're on HN, that might go without saying.

lol, pwn did not come from counterstrike. It originated from "leetspeak", which were creative misspellings that script kiddies and anarchist hackers on bbs boards (or IRC chans) would create to bypass text filters or go undetected by mods or operators. It later became part of internet culture adopted to mock n00bs.

The origin of pwn in gaming context is in quake multiplayer which predates CS by some years. I also recall seeing people on irc using it before that in the same context as cracking a system.

Unless the goal is to make Microsoft rich with storing all 2^256, anything they actually can guess would be worth changing