Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Authentication and the Have I Been Pwned API

troyhunt.com

Post reply on HN
Print view View original

41–50 of 125 posts

Re: Authentication and the Have I Been Pwned API

#41

Post by floatingatoll »

mehrdadn wrote: post #35
ksahin wrote: post #10

"After 4 and a bit years, by far and away the most popular method with an uptake of more than 90% is versioning via the URL. So that's all V3 supports. I don't care about the philosophical arguments to the contrary, I care about working software and in this case, the people have well and truly spoken. I don't want to have to maintain code and provide support for something people barely use when there's a perfectly vi…

Funny thing is here I am wondering why he didn't pass a query parameter instead of altering the path or adding a header to version the API... does anyone know? It has the advantage of being clickable while not implying the resource is different.

One reason could be constructed by example, as:
vs.
Which is to say that, depending on the application's coincidental design and structural choices over time, managing versions at /v1 /v2 /v3 might well be vastly easier for the "shoestring budget" operator than at /?v=1 /?v=2 /?v=3.

Re: Authentication and the Have I Been Pwned API

#42

Post by floatingatoll »

londons_explore wrote: post #2

Who bruteforce scrapes the HIBP API across many IP addresses when they could just download the original leaked username & password databases? Theres even a torrent file of all of them I won't link here...

Why download anything when you can simply query a public endpoint for free?

Re: Authentication and the Have I Been Pwned API

#43

Post by floatingatoll »

zxcvbn4038 wrote: post #24

Adding authentication so you know who is using your service is reasonable, but not sure why author is complaining about 1.2M requests per day, that is only 14 requests per second on average.

They consider those requests to be "bad actors". It's not necessarily about the volume of traffic, it's that they are compromised VPSes configured to perform unknown malicious activity that takes advantage of a free endpoint in support of unknown malicious intent. See also "Why do bad actors abuse this endpoint?" discussion elsethread: https://news.ycombinator.com/item?id=20480230

Re: Authentication and the Have I Been Pwned API

#44

Post by Androider »

pionar wrote: post #37
theandrewbailey wrote: post #18

> Making an authenticated call is a piece of cake, you just add an hibp-api-key header as follows: > GET https://haveibeenpwned.com/api/v3/breachedaccount/test@examp... > hibp-api-key: [your key] Wouldn't the standard Authorization: Bearer header be more compliant?

No, because it's not a bearer token. Edit for clarity: A bearer token [0] is a concept for OAuth. This is not OAuth. [0] https://tools.ietf.org/html/rfc6750#section-1.2

OAuth doesn't have a monopoly on bearer tokens. And it is literally the definition of a bearer token: you shall know the messenger who presents this token, a concept old as history itself.

Re: Authentication and the Have I Been Pwned API

#45

Post by y4mi »

Androider wrote: post #44
pionar wrote: post #37

Earlier quoted context omitted.

No, because it's not a bearer token. Edit for clarity: A bearer token [0] is a concept for OAuth. This is not OAuth. [0] https://tools.ietf.org/html/rfc6750#section-1.2

OAuth doesn't have a monopoly on bearer tokens. And it is literally the definition of a bearer token: you shall know the messenger who presents this token, a concept old as history itself.

Should every OS which uses windows be able to call itself Windows, because windows are a quite old thing as well?

Like it or not, there is an rfc for this and using it for anything else would be code smell at best

Re: Authentication and the Have I Been Pwned API

#46

Post by theandrewbailey »

pionar wrote: post #37
theandrewbailey wrote: post #18

> Making an authenticated call is a piece of cake, you just add an hibp-api-key header as follows: > GET https://haveibeenpwned.com/api/v3/breachedaccount/test@examp... > hibp-api-key: [your key] Wouldn't the standard Authorization: Bearer header be more compliant?

No, because it's not a bearer token. Edit for clarity: A bearer token [0] is a concept for OAuth. This is not OAuth. [0] https://tools.ietf.org/html/rfc6750#section-1.2

JWT uses Authorization: Bearer, too.

https://jwt.io/introduction/

Re: Authentication and the Have I Been Pwned API

#47

Post by wolco »

floatingatoll wrote: post #43
zxcvbn4038 wrote: post #24

Adding authentication so you know who is using your service is reasonable, but not sure why author is complaining about 1.2M requests per day, that is only 14 requests per second on average.

They consider those requests to be "bad actors". It's not necessarily about the volume of traffic, it's that they are compromised VPSes configured to perform unknown malicious activity that takes advantage of a free endpoint in support of unknown malicious intent. See also "Why do bad actors abuse this endpoint?" discussion elsethread: https://news.ycombinator.com/item?id=20480230

Wouldn't most api traffic come from vps's regardless of the intent?

Re: Authentication and the Have I Been Pwned API

#49

Post by floatingatoll »

wolco wrote: post #47
floatingatoll wrote: post #43

Earlier quoted context omitted.

They consider those requests to be "bad actors". It's not necessarily about the volume of traffic, it's that they are compromised VPSes configured to perform unknown malicious activity that takes advantage of a free endpoint in support of unknown malicious intent. See also "Why do bad actors abuse this endpoint?" discussion elsethread: https://news.ycombinator.com/item?id=20480230

Wouldn't most api traffic come from vps's regardless of the intent?

The article notes that the VPS providers indicated that those top API traffic consumers were all a specific cron.php on compromised VPSes, so while in theory your statement is true, in reality the issue here was maliciously-compromises VPSes, not VPSes in general.
Post reply on HN