Project Svalbard: The Future of Have I Been Pwned

Post by DanBC » Tue, Jun 11, 2019, 9:57 AM UTC

addicted wrote: post #33

rocketbop wrote: post #29

Earlier quoted context omitted.

Does this really fall foul of GDPR? I would have guessed that once your data is in the wild, there is nothing in GDPR that applies. GDPR puts certain responsibilities on groups you give your data to treat that data in certain ways in terms of who it is shared with, which would not seem to apply to someone offering a lookup of an in the wild dataset. I'm curious if my naive understanding of this is wrong.

I’m not sure how GDPR applies to HIBP. GDPR is all about data that is shared by the user. But HIBP is about data that hasn’t been shared by a user, but rather, is available publicly. It’s a grey area at the very least.

Post by flurdy » Tue, Jun 11, 2019, 10:00 AM UTC

chaitanya wrote: post #21

Many people here assuming that Troy Hunt will leave HIBP after selling it. He explicitly mentions that he will remain a part of it: > I'll remain a part of HIBP. I fully intend to be part of the acquisition, that is some company gets me along with the project. HIBP's brand is intrinsically tied to mine and at present, it needs me to go along with it.

Post by [deleted] » Tue, Jun 11, 2019, 10:02 AM UTC

Post by EugeneOZ » Tue, Jun 11, 2019, 10:10 AM UTC

hkjayakumar wrote: post #30

cm2187 wrote: post #8

I cannot say enough praises of Troy and HIBP. But it is a risky operation. I understand HIBP derives its value from grey-ish hats sharing with Troy any leaked dataset they find because they know him or because of his reputation. If he leaves, it is not clear to me that his trust and reputation will stay behind with the company running HIBP. The minute HIBP ceases to be the central place for these new datasets to be s…

> I'll remain a part of HIBP. I fully intend to be part of the acquisition, that is some company gets me along with the project. HIBP's brand is intrinsically tied to mine and at present, it needs me to go along with it. He's made it pretty clear in the blog post that he intends to stay on and has acknowledged that his reputation plays an important part in making HIBP what it is.

Post by OskarS » Tue, Jun 11, 2019, 10:16 AM UTC

rocketbop wrote: post #29

jfdhu wrote: post #27

Earlier quoted context omitted.

And whilst its impossible to police effectively the datasets on various forums, it seems KPMG and Troy Hunt are just not aware of the fact that GDPR exists. https://en.wikipedia.org/wiki/General_Data_Protection_Regula... Its quite interesting putting in various peoples email addresses to see what sites they are linked to. Maybe once he has made some money out of it, a GDPR claim and financial settlement can be made a…

Does this really fall foul of GDPR? I would have guessed that once your data is in the wild, there is nothing in GDPR that applies. GDPR puts certain responsibilities on groups you give your data to treat that data in certain ways in terms of who it is shared with, which would not seem to apply to someone offering a lookup of an in the wild dataset. I'm curious if my naive understanding of this is wrong.