Earlier quoted context omitted.
It's definitely trust in Troy, and the level of transparency he's maintained, that have led to HIBP being successful. But I, personally, would now trust Mozilla with this, were there to take ownership.
I was just thinking, the only ones I can imagine taking ownership would be one of the "big internet foundations" that have earned their trust: Mozilla, the Internet Archive, Wikimedia, or the EFF. Of those, Mozilla and the EFF are the only ones that make real sense. I hope it's one of them, and not fucking Norton AntiVirus or whatever.
Project Svalbard: The Future of Have I Been Pwned
51–60 of 160 posts
Re: Project Svalbard: The Future of Have I Been Pwned
#52Re: Project Svalbard: The Future of Have I Been Pwned
#53Wonder if he couldn't just bring it in-house?
Re: Project Svalbard: The Future of Have I Been Pwned
#54He's still a Microsoft employee is he not? Wonder if he couldn't just bring it in-house?
https://www.troyhunt.com/microsoft-regional-director/ - "I’m not going to work for Microsoft and despite the title of “Microsoft Regional Director”, I’m no more an employee than what I was (and still am) an MVP"
Re: Project Svalbard: The Future of Have I Been Pwned
#55He's still a Microsoft employee is he not? Wonder if he couldn't just bring it in-house?
Re: Project Svalbard: The Future of Have I Been Pwned
#56tl;dr He's realised he's the single point of failure, can't do it all himself, wants to balance work & family. Doesn't want the work/cost of hiring people and making a business. So, he's preparing to sell it and there's a wishlist of what he'd like the new owner to do. Did I get it all?
Re: Project Svalbard: The Future of Have I Been Pwned
#57tl;dr He's realised he's the single point of failure, can't do it all himself, wants to balance work & family. Doesn't want the work/cost of hiring people and making a business. So, he's preparing to sell it and there's a wishlist of what he'd like the new owner to do. Did I get it all?
Also he’ll stay on as part of the package.
Re: Project Svalbard: The Future of Have I Been Pwned
#58EDIT: Serious question, generate hashes out of the leaked logins, store them in a blockchain and provide an interface for lookup via IPFS. Those credentials are considered burned anyway so storing them for ever in a blockchain won't matter.
Being in a blockchain anyone can access the data and use them for example on a registration page.
Re: Project Svalbard: The Future of Have I Been Pwned
#59Can we move the project into a blockchain and run it on IPFS? EDIT: Serious question, generate hashes out of the leaked logins, store them in a blockchain and provide an interface for lookup via IPFS. Those credentials are considered burned anyway so storing them for ever in a blockchain won't matter. Being in a blockchain anyone can access the data and use them for example on a registration page.
Re: Project Svalbard: The Future of Have I Been Pwned
#60We should all do away with password complexity rules (except minimum length) and simply test a large, comprehensive exposed password bloom filter for membership. It's very fast (constant time) and efficient and if the test returns no, then it's safe for a user to select that password.
Here's the code: https://github.com/w8rbt/bp
Also note that this approach satisfies the updated (June 2017) NIST 800-63-3B password vetting guidelines.