Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Svalbard: The Future of Have I Been Pwned

troyhunt.com

Post reply on HN
Print view View original

81–90 of 160 posts

Re: Project Svalbard: The Future of Have I Been Pwned

#81

Post by w8rbt »

ttt111222333 wrote: post #77
w8rbt wrote: post #60

I hope that the SHA1 hashes remain freely available for download. I use them to build a bloom filter for password vetting. We should all do away with password complexity rules (except minimum length) and simply test a large, comprehensive exposed password bloom filter for membership. It's very fast (constant time) and efficient and if the test returns no, then it's safe for a user to select that password. Here's the…

Cool! I did something similar. First I used a bloom filter then a golomb set. https://github.com/terencechow/pwnedpasswords

Very nice. I've never used a Golomb Set (looks interesting). I bet we'll see more organizations doing this and maybe in five to ten years, it'll be the norm.

Re: Project Svalbard: The Future of Have I Been Pwned

#82

Post by AshleyGrant »

_underfl0w_ wrote: post #76
samwillis wrote: post #40

Earlier quoted context omitted.

It’s a very easy fix, confirm ownership of the email address before exposing the results.

...if the password for said email address is already visible on the same page (assuming negligent password reuse) what kind of verification could you hope for?

Have you actually used HIBP?

Re: Project Svalbard: The Future of Have I Been Pwned

#83

Post by vermilingua »

Worth mentioning that the value of HIBP is largely based on trust in Troy Hunt. I think he’s an incredible guy who does incredible work; but he’s also an Australian citizen. Due to our new surveillance laws, he could be forced to backdoor HIBP, or more likely, Pwned Passwords.

This is possibly a step by Troy to mitigate that risk, and given his position I’m surprised he didn’t mention that at all in this post.

Re: Project Svalbard: The Future of Have I Been Pwned

#84

Post by tomglynch »

nandipmakwana wrote: post #23
tomglynch wrote: post #20

Earlier quoted context omitted.

Troy works with Microsoft currently, so I doubt it would work with Mozilla as MS have Edge

Microsoft Regional Director don't work for Microsoft. If that's what you are referring to. They are recognized by Microsoft based on one's expertise & skills.

Ah yes, my mistake.

Re: Project Svalbard: The Future of Have I Been Pwned

#85

Post by jfdhu »

samwillis wrote: post #40
rocketbop wrote: post #29

Earlier quoted context omitted.

Does this really fall foul of GDPR? I would have guessed that once your data is in the wild, there is nothing in GDPR that applies. GDPR puts certain responsibilities on groups you give your data to treat that data in certain ways in terms of who it is shared with, which would not seem to apply to someone offering a lookup of an in the wild dataset. I'm curious if my naive understanding of this is wrong.

It’s a very easy fix, confirm ownership of the email address before exposing the results.

Only if in possession of the email address or domain name. Where an email address or domain name has been taken over by someone else, then sending the results to the email address instead of currently showing it on the webpage doesnt solve the problem. This data set is ripe for blackmailers, intelligence services and any company looking for intelligence on rival businesses.

Re: Project Svalbard: The Future of Have I Been Pwned

#88

Post by isoos »

GordonS wrote: post #18
cm2187 wrote: post #8

I cannot say enough praises of Troy and HIBP. But it is a risky operation. I understand HIBP derives its value from grey-ish hats sharing with Troy any leaked dataset they find because they know him or because of his reputation. If he leaves, it is not clear to me that his trust and reputation will stay behind with the company running HIBP. The minute HIBP ceases to be the central place for these new datasets to be s…

Something to keep in mind is that the datasets being shared with Troy are almost all already available on underground forums, some openly, some for sale.

I keep hearing about this, but every time without any reference. Where and how can one visit such forums?

Re: Project Svalbard: The Future of Have I Been Pwned

#89

Post by jameshart »

jfdhu wrote: post #27
GordonS wrote: post #18

Earlier quoted context omitted.

Something to keep in mind is that the datasets being shared with Troy are almost all already available on underground forums, some openly, some for sale.

And whilst its impossible to police effectively the datasets on various forums, it seems KPMG and Troy Hunt are just not aware of the fact that GDPR exists. https://en.wikipedia.org/wiki/General_Data_Protection_Regula... Its quite interesting putting in various peoples email addresses to see what sites they are linked to. Maybe once he has made some money out of it, a GDPR claim and financial settlement can be made a…

Yes, you're right, I'm sure that the guy who is at the forefront of campaigning about personal data protection, has been running this service for years, has advised governments on privacy breach regulation, and has contracts to help european governments monitor their domains for breaches, has no idea whatsoever about the most prominent personal data regulation regime in the world.

Oh wait: https://www.troyhunt.com/free-course-the-gdpr-attack-plan/ https://www.troyhunt.com/new-pluralsight-course-the-state-of... https://twitter.com/troyhunt/status/1017679101698572295

Post reply on HN