Authentication and the Have I Been Pwned API • Hacker News Board

Re: Authentication and the Have I Been Pwned API

#101

Post by elamje » Fri, Jul 19, 2019, 11:56 PM UTC

I wonder if this actually has more to do with trying to sell HIBP, than abuse. He just announced that he was selling HIBP a month or two ago. Presumably, if he can get people to pay a nominal fee now for access to the api, it makes HIBP much more valuable to a potential acquirer. If you can prove people are willing to pay $.01/month for a subscription, you can assume(as a potential acquirer) that they would pay $.02/month in the future. Much harder to sell something that is completely free because of the risk that monetization completely fails later.

In previous blog posts he mentions that he gets 99.x% cache hits on Cloudflare, then also has a cache on his Azure service. He is sponsored by Cloudflare and Microsoft and doesn’t pay for the service unless something has changed since a few months ago. If that is still true, I don’t fully buy that he is actually spending money on Microsoft api hits as the post claims.

But, I like Troy and HIBP, so maybe I’m just too much of a skeptic :-)

Re: Authentication and the Have I Been Pwned API

#102

Post by Androider » Sat, Jul 20, 2019, 1:08 AM UTC

y4mi wrote: post #58

patmorgan23 wrote: post #51

Earlier quoted context omitted.

> Should every OS which uses windows be able to call itself Windows, because windows are a quite old thing as well? > Like it or not, there is an rfc for this and using it for anything else would be code smell at best No but every OS that uses windows can call them windows....

I guess they should be able to call them windows. Can you link to any tool which uses bearer tokens and doesn't grant them through oauth2? Or it's internal, please explain how the token is obtained. I haven't seen any to date but I guess I could be wrong

It's incredibly common. See Stripe for example https://stripe.com/docs/api/authentication

Authorization: Bearer .

Re: Authentication and the Have I Been Pwned API

#103

Post by Ao7bei3s » Sat, Jul 20, 2019, 1:32 AM UTC

jtbayly wrote: post #81

zaroth wrote: post #78

Earlier quoted context omitted.

I’ve never heard Full Disclosure concepts applied to serving stolen PII in an API. The reason is that the purpose of full disclosure is to shame the vendor into ensuring the patch is made, and to warn the user base that the attack is possible, while disclosing a flaw in a commercial product. In this case, we are not effectively doing either naming or shaming by publishing actual email addresses, rather than just user…

You left out the biggest part of full disclosure in my opinion. The reason for full disclosure is because those who are affected by a security flaw in a product they are using have a right to know about the dangers of that piece of software. But once I put that down in writing I discovered you are right about the difference in this instance. The person who has the right to know about the flaw in this instance is the…

I don't think that's the most important part. Rather:

Full disclosure can also protect previously unaffected / potential future customers, by warning them of companies that have been so lax with their security that they've been breached.

So to achieve a comparable upside to full disclosure, HIBP needs to also make aggregate data publicly available. Which they do:

https://haveibeenpwned.com/PwnedWebsites

Re: Authentication and the Have I Been Pwned API

#104

Post by mehrdadn » Sat, Jul 20, 2019, 2:45 AM UTC

novaleaf wrote: post #91

mehrdadn wrote: post #35

Earlier quoted context omitted.

Funny thing is here I am wondering why he didn't pass a query parameter instead of altering the path or adding a header to version the API... does anyone know? It has the advantage of being clickable while not implying the resource is different.

one benefit of putting version in the path is it makes it easier for loadbalancers to direct traffic. like v3 could be served from different servers than v2

Why can't they do that with the query parameters?

Re: Authentication and the Have I Been Pwned API

#105

Post by Ayesh » Sat, Jul 20, 2019, 3:18 AM UTC

mehrdadn wrote: post #35

ksahin wrote: post #10

"After 4 and a bit years, by far and away the most popular method with an uptake of more than 90% is versioning via the URL. So that's all V3 supports. I don't care about the philosophical arguments to the contrary, I care about working software and in this case, the people have well and truly spoken. I don't want to have to maintain code and provide support for something people barely use when there's a perfectly vi…

Funny thing is here I am wondering why he didn't pass a query parameter instead of altering the path or adding a header to version the API... does anyone know? It has the advantage of being clickable while not implying the resource is different.

API versioning with query parameters is often an implementer nightmare.

Re: Authentication and the Have I Been Pwned API

#106

Post by mehrdadn » Sat, Jul 20, 2019, 3:25 AM UTC

Ayesh wrote: post #105

mehrdadn wrote: post #35

Earlier quoted context omitted.

Funny thing is here I am wondering why he didn't pass a query parameter instead of altering the path or adding a header to version the API... does anyone know? It has the advantage of being clickable while not implying the resource is different.

API versioning with query parameters is often an implementer nightmare.

Why..? Does it break through too many abstraction layers?

Re: Authentication and the Have I Been Pwned API

#107

Post by Ayesh » Sat, Jul 20, 2019, 3:28 AM UTC

dustinmoris wrote: post #77

jtbayly wrote: post #36

Earlier quoted context omitted.

This is such a clearly useful, legitimate service. You cannot tell the bad guys to delete your data. The next best thing is to be alerted when your data is found in a bad guy’s trove.

It's not that clear cut unfortunately. What do you really know about Troy and his service? Really just what he wants you to know. For example, Troy stores extremely valuable information about millions of people without their consent. A lesbian women in the Arabs, who might have had her credentials breached on a gay forum, who also has a gambling addiction and had her password breached on a gambling website and on ano…

This is definitely to most grateful comment I have seen on HN this far... Time out.

Re: Authentication and the Have I Been Pwned API

#108

Post by novaleaf » Sat, Jul 20, 2019, 3:56 AM UTC

mehrdadn wrote: post #104

novaleaf wrote: post #91

Earlier quoted context omitted.

one benefit of putting version in the path is it makes it easier for loadbalancers to direct traffic. like v3 could be served from different servers than v2

Why can't they do that with the query parameters?

maybe he can, but I know that google cloud's loadbalancer doesn't let you.

Re: Authentication and the Have I Been Pwned API

#109

Post by ec109685 » Sat, Jul 20, 2019, 4:08 AM UTC

yjftsjthsd-h wrote: post #5

Obvious next concern: Will bad actors just scrape the website? Putting authentication and payments in front of that rather defeats the entire point, and without that you're back to rate limiting which is exactly what has just been declared as a failed approach.

Or scrape websites that provide a proxy to the API (e.g. the cloudflare worker he described).

Re: Authentication and the Have I Been Pwned API

#110

Post by jtbayly » Sat, Jul 20, 2019, 4:18 AM UTC

diminoten wrote: post #98

nwah1 wrote: post #93

Earlier quoted context omitted.

"Disclosure" could mean many things. The idea of providing the info directly via email to the affected user seems to adequately disclose things to the relevant parties. Are there additional benefits of the public api that on balance benefit the public more than attackers?

Yeah, the availability of the data being common rather than rare, so the skill of collecting that data doesn't create a power structure where only the hackers/skilled users have power. Imagine it being $500/month to access HIBP, because that's the alternative, not some, "everyone agrees to only use this info for good".

Explain to me how anybody besides myself can use info about my leaked account for something good or useful.

I can’t think of an example.

Therefore, having that info cost more is better. Having it cost a lot more is a lot better. (I’m assuming I can still get access for free by having provided directly to my email address.)