Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I Been Pwned 2.0

troyhunt.com

Post reply on HN
Print view View original

91–100 of 323 posts

Re: Have I Been Pwned 2.0

#91

Post by _heimdall »

knowitnone wrote: post #78
jeffparsons wrote: post #62

Earlier quoted context omitted.

A company as big as LinkedIn should have bots continually accessing their site with unique generated passwords etc., and then be searching for those secrets in logging pipelines, bytes on disk, etc. to see where they get leaked. I know much smaller companies that do this. Yes, it's easy to fuck up. But a responsible company implements mitigations. And LinkedIn can absolutely afford to do much more.

that would require hiring a security personnel which they can't afford to do. /s

I think the new approach is to "hire" LLM agents to do the job, unless the hiring manager can prove they exhausted all ways an LLM could possibly have done the task.

Re: Have I Been Pwned 2.0

#92

Post by some_random »

jeffparsons wrote: post #62
miki123211 wrote: post #56

Earlier quoted context omitted.

It's actually really easy to do unintentionally. For an intervening middleware, a password field in a JSON object is just like any other field in a JSON object. You may have some kind of logging / tracking / analytics somewhere that logs request bodies. You don't even have to engage in marketing shenanigans for that to be a problem, an abuse prevention system (which is definitely a necessity at their scale) is enough…

A company as big as LinkedIn should have bots continually accessing their site with unique generated passwords etc., and then be searching for those secrets in logging pipelines, bytes on disk, etc. to see where they get leaked. I know much smaller companies that do this. Yes, it's easy to fuck up. But a responsible company implements mitigations. And LinkedIn can absolutely afford to do much more.

There are so many things that companies as big as linkedin should be doing but aren't :(

Re: Have I Been Pwned 2.0

#95

Post by flas9sd »

Saris wrote: post #93

I really wish I could put in my domain name, I have so many aliases that it's basically impossible to search each one individually.

it's right there after the "The Domain Search Feature" heading. Verify ownership, then you get results

Re: Have I Been Pwned 2.0

#96

Post by [deleted] »

anamexis wrote: post #75
mulmen wrote: post #60

Earlier quoted context omitted.

The idea of fines as a revenue stream has never sat well with me. Fines are meant to be a disincentive. The ideal collection amount is zero. Treating them as a revenue stream creates a perverse incentive to enforce the penalty without disincentivizing the behavior.

I think the problem is: 1. How else would you penalize businesses? 2. What else would you do with fines? If fines exist, it would seem foolish not to budget around that.

[deleted]

Re: Have I Been Pwned 2.0

#97

Post by mulmen »

mcmcmc wrote: post #88
mulmen wrote: post #60

Earlier quoted context omitted.

The idea of fines as a revenue stream has never sat well with me. Fines are meant to be a disincentive. The ideal collection amount is zero. Treating them as a revenue stream creates a perverse incentive to enforce the penalty without disincentivizing the behavior.

If your ideal is a perfect society where everyone follows the all rules all the time you are going to be sorely disappointed. The ideal collection amount is the size of the fine multiplied by the actual occurrence of the offense. And that revenue should be strictly used for rehabilitative or restorative justice. For example, speeding fines should go to road improvements that deter speeding making roads safer. If no o…

Yes I agree. I was replying to the suggestion to put the proceeds from fines into a general slush fund. Doing that creates an incentive to use speeding tickets to pay for police overtime and radar guns instead of traffic calming infrastructure.

Re: Have I Been Pwned 2.0

#99

Post by deepsun »

mcmcmc wrote: post #88
mulmen wrote: post #60

Earlier quoted context omitted.

The idea of fines as a revenue stream has never sat well with me. Fines are meant to be a disincentive. The ideal collection amount is zero. Treating them as a revenue stream creates a perverse incentive to enforce the penalty without disincentivizing the behavior.

If your ideal is a perfect society where everyone follows the all rules all the time you are going to be sorely disappointed. The ideal collection amount is the size of the fine multiplied by the actual occurrence of the offense. And that revenue should be strictly used for rehabilitative or restorative justice. For example, speeding fines should go to road improvements that deter speeding making roads safer. If no o…

The safest road is the closed one.

I just want to say that in modern times safety is put as #1 priority, while it's actually always a balance. E.g. we wanted the safest airline industry, we'd close the airports. But we balance the safety vs usefulness.

Post reply on HN