Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Svalbard: The Future of Have I Been Pwned

troyhunt.com

Post reply on HN
Print view View original

71–80 of 160 posts

Re: Project Svalbard: The Future of Have I Been Pwned

#71

Post by Vinnl »

flurdy wrote: post #24
tomglynch wrote: post #10

Earlier quoted context omitted.

Mozilla also recently launched their own version of HIBP that just gets the data from HIBP and passes it to their users: https://monitor.firefox.com/ Though just realised, they're not that upfront about giving HIBP credit - If I were Troy this would peeve me a bit.

I thought the same when I initially was prompted about Firefox monitor at the bottom of Firefox's new tab page. Was a little peeved at what seemed like a copy, but I have now realised it is just building on top of Troy's work [1] which is even better because of Firefox's larger reach. They don't have to have a blinking marque text at the top attributing it to Have I Been Pwned. But they could have mentioned it on the…

> I trust HIBP, therefore, more value to Firefox Monitor had I known that link.

If you trust HiBP, you don't really need Firefox Monitor. It was created specifically to reach people that HiBP could not reach.

Re: Project Svalbard: The Future of Have I Been Pwned

#72

Post by bookofjoe »

Totally off topic, but still...: Many years ago, the New York Times did a lengthy piece about the Svalbard Seed Repository, referring to it as being located on "the island of Svalbard." It took repeated emails/corrections/tweets by me before they finally corrected the story and noted "Svalbard is not an island, it is an archipelago." All subsequent references in the Times have got it right.

Re: Project Svalbard: The Future of Have I Been Pwned

#73

Post by GordonS »

shedside wrote: post #50
jedberg wrote: post #26

TL;DR: Have I Been Pwned is for sale and is being renamed Project Svalbard. Troy is looking for buyers that will keep the service free, and he'll go work with the buyer.

AIUI, “Project Svalbard” is the name of the project to find a new home for HIBP. The actual service isn’t being renamed (yet).

It is indeed common to have a "project name" when buying/selling a company - but in my experience that has always been largely for reasons of secrecy, so it is a bit odd in this case.

Re: Project Svalbard: The Future of Have I Been Pwned

#74

Post by ga-vu »

ga-vu wrote: post #61

So why was the owner of LeakedSource arrested and charged, and this guy isn't? He did the same thing. Only instead of selling to hackers, he sold our hacked data to companies and governments.

Thanks for the downvotes. Glad you can't see through this guy's marketing BS.

Re: Project Svalbard: The Future of Have I Been Pwned

#75

Post by GordonS »

sschueller wrote: post #58

Can we move the project into a blockchain and run it on IPFS? EDIT: Serious question, generate hashes out of the leaked logins, store them in a blockchain and provide an interface for lookup via IPFS. Those credentials are considered burned anyway so storing them for ever in a blockchain won't matter. Being in a blockchain anyone can access the data and use them for example on a registration page.

What value would a blockchain add here over a database?

Re: Project Svalbard: The Future of Have I Been Pwned

#76

Post by _underfl0w_ »

samwillis wrote: post #40
rocketbop wrote: post #29

Earlier quoted context omitted.

Does this really fall foul of GDPR? I would have guessed that once your data is in the wild, there is nothing in GDPR that applies. GDPR puts certain responsibilities on groups you give your data to treat that data in certain ways in terms of who it is shared with, which would not seem to apply to someone offering a lookup of an in the wild dataset. I'm curious if my naive understanding of this is wrong.

It’s a very easy fix, confirm ownership of the email address before exposing the results.

...if the password for said email address is already visible on the same page (assuming negligent password reuse) what kind of verification could you hope for?

Re: Project Svalbard: The Future of Have I Been Pwned

#77

Post by ttt111222333 »

w8rbt wrote: post #60

I hope that the SHA1 hashes remain freely available for download. I use them to build a bloom filter for password vetting. We should all do away with password complexity rules (except minimum length) and simply test a large, comprehensive exposed password bloom filter for membership. It's very fast (constant time) and efficient and if the test returns no, then it's safe for a user to select that password. Here's the…

Cool! I did something similar. First I used a bloom filter then a golomb set. https://github.com/terencechow/pwnedpasswords

Re: Project Svalbard: The Future of Have I Been Pwned

#78

Post by _underfl0w_ »

peterburkimsher wrote: post #13
trollied wrote: post #11

I'd like to see Let's Encrypt step up and run this service. Seems like a natural fit.

ProtonMail/ProtonVPN would also be a good fit, but I doubt they could afford it.

Just because they're tangentially related to infosec in some way doesn't mean they'd be a good fit.

IIRC aren't there actually privacy concerns regarding Proton? That may just be FUD.

Plus, I doubt they would maintain the level of transparency we've come to expect from HIBP. They don't seem very... transparent.

Re: Project Svalbard: The Future of Have I Been Pwned

#80

Post by bookofjoe »

bookofjoe wrote: post #72

Totally off topic, but still...: Many years ago, the New York Times did a lengthy piece about the Svalbard Seed Repository, referring to it as being located on "the island of Svalbard." It took repeated emails/corrections/tweets by me before they finally corrected the story and noted "Svalbard is not an island, it is an archipelago." All subsequent references in the Times have got it right.

Here is the correction, published on April 22, 2010: https://archive.nytimes.com/query.nytimes.com/gst/fullpage-9...
Post reply on HN