Very understandable, and also yet another example of why we can't have nice services on the Internet. Traffic from bad actors pushes anyone offering an API in a similar direction, or discontinuing it altogether.
Authentication and the Have I Been Pwned API
11–20 of 125 posts
Re: Authentication and the Have I Been Pwned API
#12Who bruteforce scrapes the HIBP API across many IP addresses when they could just download the original leaked username & password databases? Theres even a torrent file of all of them I won't link here...
Maybe spammers check if an email address is legitimate by checking HIBP. A pretty significant fraction of legitimate email addresses probably do show up in at least one list.
Re: Authentication and the Have I Been Pwned API
#13Boom, now Troy is monetizing stolen data. Unethical and illegal.
Re: Authentication and the Have I Been Pwned API
#14Makes sense. I was writing an email to Troy that he can post about how to set custom user agent in Electron and Cordova, as the defaults fail. Guess it won’t be needed.
Re: Authentication and the Have I Been Pwned API
#15Boom, now Troy is monetizing stolen data. Unethical and illegal.
It does cost money to run a service like this. He's historically had sponsors, but you can't expect someone to run a high traffic service for free forever.
Re: Authentication and the Have I Been Pwned API
#16I wish the post made more clear, ideally right at the top, that the new fee applies only to third-party apps that access the HIBP API, not to end users whose email addresses are being checked against the API. You have to read through the post a bit before that becomes clear. Individual users who just want to figure out whether they've been pwned will not have to pony up the cash. They can still visit https://haveibee…
It would also be great to emphasize that this only applies to the HIBP API, and the Pwned Passwords API will still be free. (It's mentioned about half-way through the article.)
Re: Authentication and the Have I Been Pwned API
#17Obvious next concern: Will bad actors just scrape the website? Putting authentication and payments in front of that rather defeats the entire point, and without that you're back to rate limiting which is exactly what has just been declared as a failed approach.
"Will bad actors just scrape the website?"
That's already been happening. Many simply use HIBP as a starting point to pwning someone's online accounts. Now, Troy is just going to attempt to really profit off of the actions of those bad actors.
Re: Authentication and the Have I Been Pwned API
#18> Making an authenticated call is a piece of cake, you just add an hibp-api-key header as follows:
> GET https://haveibeenpwned.com/api/v3/breachedaccount/test@examp...
> hibp-api-key: [your key]
Wouldn't the standard Authorization: Bearer header be more compliant?
Re: Authentication and the Have I Been Pwned API
#19Why are bad actors abusing the API? What benefit does it give them to just be able to check for leaked data on e-mail addresses? Especially when it doesn't actually provide the leaked data...
Re: Authentication and the Have I Been Pwned API
#20I find it ironic that a site dedicated to seeing if you have been compromised has no method of changing your API key if it is compromised.