Troy Hunt

This is a really informative write-up and an excellent learning exercise.

It's worth noting that haveibeenpwned's API has a really clever design for allowing people to look up their passwords without transmitting them to the site.

It's explained here: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/

The short version is that you can take the first 5 characters of a SHA-1 hash and hit this endpoint:

https://api.pwnedpasswords.com/range/21BD1

The endpoint returns (right now) a list of 528 full hashes along with counts. You can compare your full calculated SHA-1 hash to that list to see if the password is present in the dump.

The trick here is called k-Anonymity - I think it's a really elegant solution. This technique is written up in more detail here: https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/

Probably worth noting that Have I Been Pwned is now up for sale: https://www.troyhunt.com/project-svalbard-the-future-of-have-i-been-pwned/

I've always been a huge fan of the project (and Troy) and understand that it's gotten to a point where he can't keep running it as a spare-time project, but I'm still not very happy about seeing it being shopped around. I can't see how this type of service needing to find a way to become a business will be a good thing overall, especially when it keeps getting integrated into other programs and services like this. Troy pledges that nothing will change, but every company getting acquired does that, and then things change anyway.

The best result would probably be something like Mozilla buying it and/or paying Troy to just keep doing what he's doing.

Frankly, USD3.50/month for API access is still an incredible bargain for a service of this quality. Normal users can still use the webpage form to look themselves up for free, API users pay a nominal fee that should cover the cost of the resources they consume.

The only concern I can think of is that this opens the gate to raising the fee in the future to profit from it, considering that Troy is "selling out" soon [1] and will not be in control of the service for ever. HIBP is the kind of service I think ought to be provided by a non-profit entity. But Troy's record is good, so I have faith that he will do his best to pick a good new home for HIBP.

[1] https://www.troyhunt.com/project-svalbard-the-future-of-have-i-been-pwned/

The k-anonymity is such a clever trick, I remember being impressed by the simplicity and efficacy of it back when I read about it also.

I'd also like to call out the one who Troy says suggested him [1], Junade Ali who goes into more details about this in his post about it [2]

Not because Junade would have invented it (apparently that was Pierangela Samarati, Latanya Sweeney and Tore Dalenius. [3]) but because his blog post on it is a really great explainer of it using concepts software developers are familiar with.

[1] https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/
[2] https://blog.cloudflare.com/validating-leaked-passwords-with-k-anonymity/
[3] https://en.wikipedia.org/wiki/K-anonymity

Just let that number sink in a bit. 80M/2844 = ~30K accounts / breach.

And still, just about every service that you have to make use of (your HOA, your insurance company, your government and so on) wants you to trust them with your data secured by a userid and a password that they will administer on infrastructure that they are most likely not competent to secure.

One of the best things to come out of the GDPR is the reporting requirements for breaches. You can expect a lot more of these updates in the future.

Edit: interesting, the link now goes to 'https://ghost.org/fail/', a 404, so go to https://www.troyhunt.com/

For a good discussion into why _all_ websites should use HTTPS, I'd highly recommend this article.

https://www.troyhunt.com/heres-why-your-static-website-needs-https/

Not having your site as HTTPS puts all of your readers at risk. Even US ISPs like that of Comcast use this very same practice to inject warnings into insecure web traffic[0]. And like mentioned in the article, promises from ISPs not to use it for advertisements are just that, promises, and those can be broken in an instant.

[0]: https://gizmodo.com/comcast-to-customer-who-noticed-it-secretly-injecting-c-1821235362