Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Project Svalbard: The Future of Have I Been Pwned

troyhunt.com

Post reply on HN
Print view View original

141–150 of 160 posts

Re: Project Svalbard: The Future of Have I Been Pwned

#141

Post by bobbiechen »

pbhjpbhj wrote: post #14
GordonS wrote: post #5

I'd love to see a non-profit organisation like Mozilla pick this up, but that's obviously going to mean a lot less money going to Troy. OTOH, it's kind of difficult to begrudge Troy gaining financially from HIBP, since he's spent years building it up and has helped increase security awareness for so many people.

HIBP only works because of trust in Troy Hunt, few organisations have that. Maybe an organisation not involved in advertising at any level.

It calls to mind the trust in Jon Postel, who managed DNS through IANA for about 10 years basically alone until his death in 1998 and IANA's subsequent transfer to ICANN (which had just been founded).

Since Troy will still be involved, hopefully he can steer things in a direction that benefits everyone - or at least warn the public otherwise.

Re: Project Svalbard: The Future of Have I Been Pwned

#142

Post by WorldMaker »

GordonS wrote: post #5

I'd love to see a non-profit organisation like Mozilla pick this up, but that's obviously going to mean a lot less money going to Troy. OTOH, it's kind of difficult to begrudge Troy gaining financially from HIBP, since he's spent years building it up and has helped increase security awareness for so many people.

I also think that HIBP is something of a "public good" and would be best for some sort of non-profit or another. Mozilla is possibly the best currently aligned, of course.

Another weird thought is that it's the sort of "baseline infrastructure" that should be "governmental" to the internet. Unfortunately the closest I can think to an existing model for that is ICANN and that may not be something to emulate.

Re: Project Svalbard: The Future of Have I Been Pwned

#143

Post by Ntrails »

nebulous1 wrote: post #119
jshowa3 wrote: post #105

Earlier quoted context omitted.

This isn't, by no means, a belittlement against Troy Hunt, but here are some things to consider: What makes Troy Hunt any more trustworthy? Do you think he can't make a mistake? What if his operation suddenly can't handle something because of X reason? What if he's breached himself or any of the services he's using break down or worse, provide invalid data or incorrect data? What if user Y searches his site, finds ou…

I'm afraid I agree with basically nothing you've written here! I trust Troy Hunt more than I trust OP's examples of Facebook and Verizon. I also trust his competence more than I trust theirs. Whose to say that anybody won't make any of the mistakes you mention. FWIW I would doubt he would sell to either of these companies, but it's undeniable that you give up control when you sell and people have made incorrect judgm…

> FWIW I would doubt he would sell to either of these companies

He might not, but 6 months later the company he sells to *might. Or if public could be taken over with little choice in the matter.

As you say, control is gone once he sells.

Re: Project Svalbard: The Future of Have I Been Pwned

#145

Post by OJFord »

jimktrains2 wrote: post #117
OJFord wrote: post #114

In some ways, wouldn't it be great if the internet had evolved with, analogously to DNS, 'User Name Servers', like a sort of global distributed IAM? Leak monitoring would be a service provided by the UNS, not falling to a volunteer, and credential revocation could be automatic and immediate. I suppose we sort of have that bolted on with OpenID/OAuth, but that's still 'choose a provider' rather than 'this is the one w…

It's existed since 1988: LDAP/X.500[1] It's just not used globally because of three reasons, as far as I can tell, 1) most people don't want their information public and searchable to that extent 2) most orgs _want_ to silo you in or otherwise control your account 3) the org using x500 still needs to have their own permissions separate from the central directory, which is the harder part of auth[nz], so just rolling…

Ah yes, and Shibboleth is another I should've thought of in earlier comment.

I think you're absolutely right in particular with #2.

But if it had come originally, alongside DNS, 'everything has an address, everyone has an identity', it might've been an unquestionable fact of the internet.

Orgs can't silo you in to their alternate net where they have a more desirable domain name, because it's just not practical or user friendly.

I just think it might have been so for user identity.

Re: Project Svalbard: The Future of Have I Been Pwned

#146

Post by OJFord »

fanf2 wrote: post #139
OJFord wrote: post #114

In some ways, wouldn't it be great if the internet had evolved with, analogously to DNS, 'User Name Servers', like a sort of global distributed IAM? Leak monitoring would be a service provided by the UNS, not falling to a volunteer, and credential revocation could be automatic and immediate. I suppose we sort of have that bolted on with OpenID/OAuth, but that's still 'choose a provider' rather than 'this is the one w…

There is a recent RFC which applies the DNS to security checks for passwords, credit cards, etc. https://tools.ietf.org/html/rfc8567

At first glance it seems worth reading properly tomorrow. Except, '1 April', is it a gag RFC? (In a way, I suppose, it doesn't matter - those tend to be as worthwhile!)

Re: Project Svalbard: The Future of Have I Been Pwned

#147

Post by vermilingua »

paranoidrobot wrote: post #121
vermilingua wrote: post #83

Worth mentioning that the value of HIBP is largely based on trust in Troy Hunt. I think he’s an incredible guy who does incredible work; but he’s also an Australian citizen. Due to our new surveillance laws, he could be forced to backdoor HIBP, or more likely, Pwned Passwords. This is possibly a step by Troy to mitigate that risk, and given his position I’m surprised he didn’t mention that at all in this post.

What would backdooring HIBP achieve? It's not a repository or method of communications.

Pwned Passwords uses tricky crypto to make sure his service never sees your full password. He could use trickier crypto to make sure that it does.

Re: Project Svalbard: The Future of Have I Been Pwned

#148

Post by paranoidrobot »

vermilingua wrote: post #147
paranoidrobot wrote: post #121

Earlier quoted context omitted.

What would backdooring HIBP achieve? It's not a repository or method of communications.

Pwned Passwords uses tricky crypto to make sure his service never sees your full password. He could use trickier crypto to make sure that it does.

I think that's a bit of a reach.

That's all client/requester side, which has been implemented on third party sites/services. There'd be a lot of questions raised if suddenly it required that you use a different technique.

A more subtle and (IMO) more realistic variant would be to backdoor the javascript to capture all input on that site instead.

But you have to ask yourself - who would be the government target, in that case?

They'd have to:

- Have a technically sophisticated target where the government doesn't know their password, and is unable to otherwise break their security (eg forcing Google/Apple/Microsoft/etc to do the work, cloning devices, regular surveilance) - Have that same target also regularly test their passwords against a password strength meter on the public webpage. - Be willing to risk a public leak that this was happening.

I don't think that anyone who meets the first point would be stupid enough to meet the second. I mean, sure, people make plenty of dumb mistakes - but surely not that one, repeatedly.

Re: Project Svalbard: The Future of Have I Been Pwned

#149

Post by vermilingua »

paranoidrobot wrote: post #148
vermilingua wrote: post #147

Earlier quoted context omitted.

Pwned Passwords uses tricky crypto to make sure his service never sees your full password. He could use trickier crypto to make sure that it does.

I think that's a bit of a reach. That's all client/requester side, which has been implemented on third party sites/services. There'd be a lot of questions raised if suddenly it required that you use a different technique. A more subtle and (IMO) more realistic variant would be to backdoor the javascript to capture all input on that site instead. But you have to ask yourself - who would be the government target, in th…

It is a reach yes, but that doesn’t change the fact that Troy is in a position of trust; which may not be wise given his citizenship.

Re: Project Svalbard: The Future of Have I Been Pwned

#150

Post by andimm »

mandeepj wrote: post #115
andimm wrote: post #55

Earlier quoted context omitted.

He was not a Microsoft employee. He is a MVP but worked for Pfizer iirc. Now he is with Pluralsight.

> Now he is with Pluralsight You sure? As far I know, he's an independent now.

You're right, he once worte:

>I won’t be working for Pluralsight in the traditional sense of drawing a salary, but rather continuing to work with them on a heap of new things.

Post reply on HN