Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Authentication and the Have I Been Pwned API

troyhunt.com

Post reply on HN
Print view View original

51–60 of 125 posts

Re: Authentication and the Have I Been Pwned API

#51

Post by patmorgan23 »

y4mi wrote: post #45
Androider wrote: post #44

Earlier quoted context omitted.

OAuth doesn't have a monopoly on bearer tokens. And it is literally the definition of a bearer token: you shall know the messenger who presents this token, a concept old as history itself.

Should every OS which uses windows be able to call itself Windows, because windows are a quite old thing as well? Like it or not, there is an rfc for this and using it for anything else would be code smell at best

> Should every OS which uses windows be able to call itself Windows, because windows are a quite old thing as well?

> Like it or not, there is an rfc for this and using it for anything else would be code smell at best

No but every OS that uses windows can call them windows....

Re: Authentication and the Have I Been Pwned API

#52

Post by wolco »

sucrose wrote: post #21
w3rhn2j34oh5o wrote: post #13

Boom, now Troy is monetizing stolen data. Unethical and illegal.

I don't see it as him monetizing the stolen data, but the mere existence of it.

No getting around that he sell access to stolen data.

He didn't orginally steal it. He collected the illegal dumps and runs a service on top of that data.

There is nothing wrong selling stolen data provided someone else dumped it first.

Re: Authentication and the Have I Been Pwned API

#53

Post by wolco »

jtbayly wrote: post #36
dustinmoris wrote: post #27

> One thing I want to be crystal clear about here is that the $3.50 fee is no way an attempt to monetise something I always wanted to provide for free. If this was true, then all revenue made from those 3.5 would get donated to a worthy cause, not donated into Troy's own pocket. I am not saying that he shouldn't monetise it, but please let's be honest about it. > The point is that the $3.50 number is pretty much bang…

This is such a clearly useful, legitimate service. You cannot tell the bad guys to delete your data. The next best thing is to be alerted when your data is found in a bad guy’s trove.

Just because you have a legitimate reason doesn't mean everyone does.

There are no bad guys just selfo serving people.

Re: Authentication and the Have I Been Pwned API

#54

Post by penagwin »

w3rhn2j34oh5o wrote: post #13

Boom, now Troy is monetizing stolen data. Unethical and illegal.

He gives a cost breakdown showing that he's almost guaranteed to lose money off it. Azure is charging him 3.5$ per 1 million calls to ratelimit/charge people for using the api. He's charging 3.5$. Consider that Stripe will be taking another 35 cents or so... lets just say if this was a monetization method it's not a very good one.

Re: Authentication and the Have I Been Pwned API

#55

Post by JoshTriplett »

> Late last year after seeing a similar pattern with a well-known hosting provider, I reached out to them to try and better understand what was going on. I provided a bunch of IP addresses which they promptly investigated and reported back to me on

I'd love to know how to get a hosting provider to actually answer such requests. (I hope the answer isn't just "be high profile". I'm hoping the answer is more like "know the right people to contact or the right phrasing to get through first-line support".)

I've reached out to hosting providers before, providing clear logs of malicious activity, and either gotten no answer, or occasionally gotten a rote "prove it came from us" that would trivially have been answered by actually reading the logs.

(Examples of such logs include SSH brute-forcing attempts, HTTP logs showing attempts to exploit web-app security holes, and spam headers showing the IP that contacted my provider's mail server.)

I've mostly stopped even trying, due to the near-zero response rate.

In an ideal world, I'd love to see reports like this lead to "we can confirm and we've shut down outbound traffic from that system until it gets fixed".

Re: Authentication and the Have I Been Pwned API

#56

Post by mehrdadn »

floatingatoll wrote: post #41
mehrdadn wrote: post #35

Earlier quoted context omitted.

Funny thing is here I am wondering why he didn't pass a query parameter instead of altering the path or adding a header to version the API... does anyone know? It has the advantage of being clickable while not implying the resource is different.

One reason could be constructed by example, as: vs. Which is to say that, depending on the application's coincidental design and structural choices over time, managing versions at /v1 /v2 /v3 might well be vastly easier for the "shoestring budget" operator than at /?v=1 /?v=2 /?v=3.

It seems unlikely considering the other 3 were more drastically different and yet seen as pretty equally easy.

Re: Authentication and the Have I Been Pwned API

#57

Post by DINKDINK »

gen3 wrote: post #30
DINKDINK wrote: post #28

All the ways congestion controls are implemented on the web lead to a cognitively infantilizing UX, privacy violations, and even "skynet" enabling[1] (hyperbolic but nothing stopping it from happening). "Are you really human? What's: 3 x 9" "Can you click on images of buses?, hmmmm don't believe you're human still, can you click images of stores, hmmm now bikes, hmmm now vehicles, oh I didn't mean all vehicles I just…

Why do something that is so complicated and time consuming to implement when charging $3.50 is good enough? Its easier for him, as he can use already made tools, and its easier for me because I don't have to add all this extra overhead (and money) to a project. It's just $3.50 and a header.

"Why would anyone put film in their camera, take a picture, have it developed, scan it, email it, all so that I can print it on a dot matrix? That's so complicated; I could just put it in a manilla envelope and send it through the postal service. Why do I need a new way to send information?"

If you want to continue using legacy technology, that's fine. If you're not comfortable with your bits being in a computer, that's fine. But it'll be slower, more expensive, and less transnational etc.

Re: Authentication and the Have I Been Pwned API

#58

Post by y4mi »

patmorgan23 wrote: post #51
y4mi wrote: post #45

Earlier quoted context omitted.

Should every OS which uses windows be able to call itself Windows, because windows are a quite old thing as well? Like it or not, there is an rfc for this and using it for anything else would be code smell at best

> Should every OS which uses windows be able to call itself Windows, because windows are a quite old thing as well? > Like it or not, there is an rfc for this and using it for anything else would be code smell at best No but every OS that uses windows can call them windows....

I guess they should be able to call them windows.

Can you link to any tool which uses bearer tokens and doesn't grant them through oauth2?

Or it's internal, please explain how the token is obtained.

I haven't seen any to date but I guess I could be wrong

Re: Authentication and the Have I Been Pwned API

#59

Post by DINKDINK »

skybrian wrote: post #31
DINKDINK wrote: post #28

All the ways congestion controls are implemented on the web lead to a cognitively infantilizing UX, privacy violations, and even "skynet" enabling[1] (hyperbolic but nothing stopping it from happening). "Are you really human? What's: 3 x 9" "Can you click on images of buses?, hmmmm don't believe you're human still, can you click images of stores, hmmm now bikes, hmmm now vehicles, oh I didn't mean all vehicles I just…

That would only solve paying for services if you are an amoral service provider and don't care where the money really comes from as long as you get paid. It doesn't do anything for people who don't want their services used by bad actors, which is increasingly the case these days - see all the people concerned about privacy and how big tech companies use their data. It's not going to help for anything social where you…

>It doesn't do anything for people who don't want their services used by bad actors, which is increasingly the case these days

My comment illustrates precisely how such an incentive structure denies high-resource demand users.

>That would only solve paying for services if you are an amoral service provider and don't care where the money really comes from as long as you get paid.

This makes no sense to me, sorry. Are you claiming that anyone who accepts cash payments is amoral because a euro/dollar bill could be stolen and equivalently people who accept bitcoin payments are amoral because they don't surveil their customer's financial history?

Re: Authentication and the Have I Been Pwned API

#60

Post by theandrewbailey »

floatingatoll wrote: post #40
theandrewbailey wrote: post #18

> Making an authenticated call is a piece of cake, you just add an hibp-api-key header as follows: > GET https://haveibeenpwned.com/api/v3/breachedaccount/test@examp... > hibp-api-key: [your key] Wouldn't the standard Authorization: Bearer header be more compliant?

See also elsethread about "not a token" — but, also: > There's a couple of these and they're largely due to me trying to make sure I get this feature out as early as possible and continue to run things on a shoestring cost wise Using the Authorization header can cause significant problems with both clients and servers, and also might unintentionally permit browsers to directly query the server if they can be convince…

I'm not sure how browsers using the API would be a concern. Someone paid for the key, so it should be up to them to use it how they please (within rate limits).
Post reply on HN