Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Authentication and the Have I Been Pwned API

troyhunt.com

Post reply on HN
Print view View original

61–70 of 125 posts

Re: Authentication and the Have I Been Pwned API

#61

Post by gen3 »

DINKDINK wrote: post #57
gen3 wrote: post #30

Earlier quoted context omitted.

Why do something that is so complicated and time consuming to implement when charging $3.50 is good enough? Its easier for him, as he can use already made tools, and its easier for me because I don't have to add all this extra overhead (and money) to a project. It's just $3.50 and a header.

"Why would anyone put film in their camera, take a picture, have it developed, scan it, email it, all so that I can print it on a dot matrix? That's so complicated; I could just put it in a manilla envelope and send it through the postal service. Why do I need a new way to send information?" If you want to continue using legacy technology, that's fine. If you're not comfortable with your bits being in a computer, tha…

> But it'll be slower, more expensive, and less transnational etc

That's the issue with your idea though. For the current status quo all I need is a valid credit card and the ability to type "curl -H "hibp-api-key: " https://haveibeenpwned.com/api/v3/breachedaccount/test@examp...

I can have that done in less then 60 seconds, it fits his threat model, and can be done in any language with a tcp lib.

Your idea isn't bad, it just does not fit the problem.

Re: Authentication and the Have I Been Pwned API

#62

Post by eli »

jtbayly wrote: post #38
zaroth wrote: post #33

All this seems to be hinting more than ever, that the time to provide these results directly and exclusively to the email address being queried is approaching. Why is this API being abused? Because it provides valuable information—which took a significant amount of effort to curate—about an email address. The list of services which have lost my (hashed or not) password at some point ever in the past eventually turns…

You’ve convinced me. I didn’t know anybody could lookup my info. I only want it for myself. Only thing is, there are a couple of old email addresses I used to use that I don’t have access to anymore. I guess I just need to shrug at that at this point.

The bad guys have access to it either way. That's the whole point: this is data that already leaked.

Re: Authentication and the Have I Been Pwned API

#63

Post by jtbayly »

eli wrote: post #62
jtbayly wrote: post #38

Earlier quoted context omitted.

You’ve convinced me. I didn’t know anybody could lookup my info. I only want it for myself. Only thing is, there are a couple of old email addresses I used to use that I don’t have access to anymore. I guess I just need to shrug at that at this point.

The bad guys have access to it either way. That's the whole point: this is data that already leaked.

As discussed elsewhere in this thread, there are real benefits provided to bad guys by allowing them to look up this information about anybody in a central location.

Re: Authentication and the Have I Been Pwned API

#64

Post by eli »

jtbayly wrote: post #63
eli wrote: post #62

Earlier quoted context omitted.

The bad guys have access to it either way. That's the whole point: this is data that already leaked.

As discussed elsewhere in this thread, there are real benefits provided to bad guys by allowing them to look up this information about anybody in a central location.

This just feels like another iteration of the Full Disclosure debate.

Re: Authentication and the Have I Been Pwned API

#65

Post by coderholic »

JoshTriplett wrote: post #55

> Late last year after seeing a similar pattern with a well-known hosting provider, I reached out to them to try and better understand what was going on. I provided a bunch of IP addresses which they promptly investigated and reported back to me on I'd love to know how to get a hosting provider to actually answer such requests. (I hope the answer isn't just "be high profile". I'm hoping the answer is more like "know…

How are you contacting them? If you use the correct abuse contact you'll usually get a response. We (IPinfo.io) are adding abuse contact info to our API within the next week or so (see https://twitter.com/ipinfoio/status/1138901541937602560) - let me know if you'd like early access.

Re: Authentication and the Have I Been Pwned API

#66

Post by jtbayly »

wolco wrote: post #53
jtbayly wrote: post #36

Earlier quoted context omitted.

This is such a clearly useful, legitimate service. You cannot tell the bad guys to delete your data. The next best thing is to be alerted when your data is found in a bad guy’s trove.

Just because you have a legitimate reason doesn't mean everyone does. There are no bad guys just selfo serving people.

As I've said elsewhere in this thread, I've come to realize that giving other people the ability to mine my data is definitely different than what I understood this service to be about. However, it's apparently what he does. And now he charges for it. I definitely see a problem here.

Of course, if there's no bad guys, I guess you don't see any problem. That's one weird point of view.

Re: Authentication and the Have I Been Pwned API

#67

Post by jtbayly »

eli wrote: post #64
jtbayly wrote: post #63

Earlier quoted context omitted.

As discussed elsewhere in this thread, there are real benefits provided to bad guys by allowing them to look up this information about anybody in a central location.

This just feels like another iteration of the Full Disclosure debate.

Interesting. Good point. I'll have to think about that.

Re: Authentication and the Have I Been Pwned API

#68

Post by X-Istence »

y4mi wrote: post #58
patmorgan23 wrote: post #51

Earlier quoted context omitted.

> Should every OS which uses windows be able to call itself Windows, because windows are a quite old thing as well? > Like it or not, there is an rfc for this and using it for anything else would be code smell at best No but every OS that uses windows can call them windows....

I guess they should be able to call them windows. Can you link to any tool which uses bearer tokens and doesn't grant them through oauth2? Or it's internal, please explain how the token is obtained. I haven't seen any to date but I guess I could be wrong

Github will happily hand you an access token by visiting "https://github.com/settings/tokens".

These are bearer tokens, in that the bearer gets granted access by that token alone.

You happen to send it along in a Basic authentication in HTTP instead of as an Authorization header, but it is a bearer token all the same.

No OAuth2 flow required.

Re: Authentication and the Have I Been Pwned API

#69

Post by X-Istence »

X-Istence wrote: post #68
y4mi wrote: post #58

Earlier quoted context omitted.

I guess they should be able to call them windows. Can you link to any tool which uses bearer tokens and doesn't grant them through oauth2? Or it's internal, please explain how the token is obtained. I haven't seen any to date but I guess I could be wrong

Github will happily hand you an access token by visiting " https://github.com/settings/tokens" . These are bearer tokens, in that the bearer gets granted access by that token alone. You happen to send it along in a Basic authentication in HTTP instead of as an Authorization header, but it is a bearer token all the same. No OAuth2 flow required.

Any service that uses API keys are basically handing out bearer tokens. Whoever holds that API key can make requests to the service, it grants you access.

Re: Authentication and the Have I Been Pwned API

#70

Post by abathur »

londons_explore wrote: post #2

Who bruteforce scrapes the HIBP API across many IP addresses when they could just download the original leaked username & password databases? Theres even a torrent file of all of them I won't link here...

The compromised servers might be doing some primary work to which these queries are incidental, rather than for the purpose of scraping the database.

In such a case, the API may be saving them from needing to build infrastructure to accumulate the database and either distribute slices of the data or host their own API for their distributed software to use.

While the database may be valuable, they'd still have to invest a lot of time and some amount of money, face the same need to secure their API against exploitation by others, leave a stronger footprint leaving back to themselves, and have to depend on a service that is more likely to get flagged as a sure sign of suspicious activity than HIBP...

Post reply on HN