Live data from Hacker News

Project Svalbard: The Future of Have I Been Pwned

troyhunt.com

51–60 of 160 posts

Re: Project Svalbard: The Future of Have I Been Pwned

#51
post #34
post #17

Earlier quoted context omitted.

It's definitely trust in Troy, and the level of transparency he's maintained, that have led to HIBP being successful. But I, personally, would now trust Mozilla with this, were there to take ownership.

I was just thinking, the only ones I can imagine taking ownership would be one of the "big internet foundations" that have earned their trust: Mozilla, the Internet Archive, Wikimedia, or the EFF. Of those, Mozilla and the EFF are the only ones that make real sense. I hope it's one of them, and not fucking Norton AntiVirus or whatever.

I agree about EFF - I'd be happy with Mozilla or EFF.

Re: Project Svalbard: The Future of Have I Been Pwned

#52

I'd like to see Let's Encrypt step up and run this service. Seems like a natural fit.

ProtonMail/ProtonVPN would also be a good fit, but I doubt they could afford it.

Why would they be a good fit?

Re: Project Svalbard: The Future of Have I Been Pwned

#54
post #53

He's still a Microsoft employee is he not? Wonder if he couldn't just bring it in-house?

When has he ever worked for Microsoft? https://www.linkedin.com/in/troyhunt/

https://www.troyhunt.com/microsoft-regional-director/ - "I’m not going to work for Microsoft and despite the title of “Microsoft Regional Director”, I’m no more an employee than what I was (and still am) an MVP"

Re: Project Svalbard: The Future of Have I Been Pwned

#56
post #7

tl;dr He's realised he's the single point of failure, can't do it all himself, wants to balance work & family. Doesn't want the work/cost of hiring people and making a business. So, he's preparing to sell it and there's a wishlist of what he'd like the new owner to do. Did I get it all?

Also he’ll stay on as part of the package.

Re: Project Svalbard: The Future of Have I Been Pwned

#57
post #7

tl;dr He's realised he's the single point of failure, can't do it all himself, wants to balance work & family. Doesn't want the work/cost of hiring people and making a business. So, he's preparing to sell it and there's a wishlist of what he'd like the new owner to do. Did I get it all?

Also he’ll stay on as part of the package.

Hello See how you can make a steady passive incomes of $100 daily on virta stock trading without you risking your money and your investment visit the website here http://www.virtatrade.com/index.php for more details

Re: Project Svalbard: The Future of Have I Been Pwned

#58
Can we move the project into a blockchain and run it on IPFS?

EDIT: Serious question, generate hashes out of the leaked logins, store them in a blockchain and provide an interface for lookup via IPFS. Those credentials are considered burned anyway so storing them for ever in a blockchain won't matter.

Being in a blockchain anyone can access the data and use them for example on a registration page.

Re: Project Svalbard: The Future of Have I Been Pwned

#59

Can we move the project into a blockchain and run it on IPFS? EDIT: Serious question, generate hashes out of the leaked logins, store them in a blockchain and provide an interface for lookup via IPFS. Those credentials are considered burned anyway so storing them for ever in a blockchain won't matter. Being in a blockchain anyone can access the data and use them for example on a registration page.

HN has warped my view on these things so much that I'm not sure whether this is a genuine question or some kind of inside joke?

Re: Project Svalbard: The Future of Have I Been Pwned

#60
I hope that the SHA1 hashes remain freely available for download. I use them to build a bloom filter for password vetting.

We should all do away with password complexity rules (except minimum length) and simply test a large, comprehensive exposed password bloom filter for membership. It's very fast (constant time) and efficient and if the test returns no, then it's safe for a user to select that password.

Here's the code: https://github.com/w8rbt/bp

Also note that this approach satisfies the updated (June 2017) NIST 800-63-3B password vetting guidelines.

Post reply on HN