Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Thoughts on a website-embeddable, credential validating service?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 19 posts

Ask HN: Thoughts on a website-embeddable, credential validating service?

#1

Post by estroz »

Reading Troy Hunt's password release V2 blog post [0], I came across the NIST recommendation to prevent users from creating accounts with passwords discovered in data breaches. This got me thinking: would a website admin (ex. small business owner with a custom website) benefit from a service that validates user passwords? The idea is to create a registration iframe with forms for email, password, etc., which would check hashed credentials against a database of data from breaches. Additionally, client-side validation would enforce rules recommended by the NIST's Digital Identity Guidelines [1], which would relieve admins from implementing their own rules. I'm sure there are additional security features that can be added.

1. Have you seen a need for this type of service, and could you see this being adopted at all?

2. Do you know of a service like this? I've looked, no hits so far.

3. Does the architecture seem sound?

[0]: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/

[1]: https://www.nist.gov/itl/tig/projects/special-publication-800-63

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#2

Post by westurner »

blockchain-certificates/cert-verifier-js: https://github.com/blockchain-certificates/cert-verifier-js

> A library to enable parsing and verifying a Blockcert. This can be used as a node package or in a browser. The browserified script is available as verifier.js.

https://github.com/blockchain-certificates/cert-issuer

> The cert-issuer project issues blockchain certificates by creating a transaction from the issuing institution to the recipient on the Bitcoin blockchain that includes the hash of the certificate itself.

... We could/should also store X.509 cert hashes in a blockchain.

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#3

Post by jimrandomh »

It sounds like this architecture (particularly the iframe bit) involves submitting the users' passwords to a third-party service to be validated. Developers and admins are likely to be hesitant about that, because the service host will end up being a significant target and a potential point of failure. This is partially avoidable; you can hash the password on the client and send the hash, and compare against the hashes of passwords from data breaches. Unfortunately, this doesn't work if you use a properly salted hash, which means that, with a reasonable amount of computational power, you'll be able to break all the password hashes submitted this way in bulk with a rainbow table. This would make your service a target, and make potential users of your service hesitate to adopt it.

A better architecture might be to distribute a library which downloads the publicly-leaked-password database so that new passwords can be checked without sending them to a third party. I can see this being a successful open source project or a side project of a large company, but I can't see site operators paying enough for that to build a business around it.

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#4

Post by colonelxc »

Why not a javascript library instead of a service?

This allows clients to self-host the javascript (so it can't be modified to log the plain text password somewhere), and probably can plug into existing form validation with little hassle.

I guess the question is why should I trust your service more than using Troy Hunt's API directly. If you're sending hashed credentials anyways, all the verification of NIST recommendations needs to be done client side anyways.

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#5

Post by estroz »

colonelxc wrote: post #4

Why not a javascript library instead of a service? This allows clients to self-host the javascript (so it can't be modified to log the plain text password somewhere), and probably can plug into existing form validation with little hassle. I guess the question is why should I trust your service more than using Troy Hunt's API directly. If you're sending hashed credentials anyways, all the verification of NIST recommen…

There is no reason to trust this service over Troy Hunt's API. In fact I would use his API if I could guarantee that I wouldn't hit the rate limit too easily, as I'd rather not come across as a spammer. I would reach out to him if I did end up using his API. A library seems to be a good (and more secure) alternative to a service, and is a path I will consider if I decide to start this project.

On your comment about sending hashed creds: credentials would have to be sent to some server hosting the database, as the database would be quite large (for example, there are ~500 million password hashes in Troy Hunt's V2 release). That is the only networked component of the proposed service. Everything else would indeed be done client-side (with the current feature set).

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#6

Post by estroz »

jimrandomh wrote: post #3

It sounds like this architecture (particularly the iframe bit) involves submitting the users' passwords to a third-party service to be validated. Developers and admins are likely to be hesitant about that, because the service host will end up being a significant target and a potential point of failure. This is partially avoidable; you can hash the password on the client and send the hash, and compare against the hash…

The library alternative was suggested in another comment and is definitely a path I'll consider over a service. The goal of this project wouldn't necessarily be to start a business, but to help standardise how websites interact with sensitive user data.

Perhaps encrypting hashed passwords with a session key and matching against hashes encrypted with that key server-side would solve the issue you mention.

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#7

Post by bgdkbtv »

Why do you think this would need a service?

It’s really easy to make as a dev using Have I Been Pwned Password API: https://twitter.com/noncototient/status/966628069048950784

Unless you’re talking about users whose dev skills only go as far as posting Wordpress articles. Then it might work, but integration would have to be super simple, I frame might not be the easiest solution for them.

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#8

Post by estroz »

bgdkbtv wrote: post #7

Why do you think this would need a service? It’s really easy to make as a dev using Have I Been Pwned Password API: https://twitter.com/noncototient/status/966628069048950784 Unless you’re talking about users whose dev skills only go as far as posting Wordpress articles. Then it might work, but integration would have to be super simple, I frame might not be the easiest solution for them.

Unsophisticated users are exactly who I would be targeting. I would likely have to make widgets to integrate with common site building services like WP. An iframe is likely the simplest solution if they're building a site from scratch though.

Re: Ask HN: Thoughts on a website-embeddable, credential validating service?

#10

Post by estroz »

albertgoeswoof wrote: post #9

If you’re going to need a service like this to validate your passwords, it’s probably easier for you to use an oAuth provider (eg Facebook) or mangaged auth provider like auth0, firebase etc. And let them handle it.

Ideally that's what site owners should lean towards. However OAuth is a problem for users who don't have accounts with offered providers.
Post reply on HN