Authentication and the Have I Been Pwned API
troyhunt.com
Authentication and the Have I Been Pwned API
1–10 of 125 posts
Re: Authentication and the Have I Been Pwned API
#2Who bruteforce scrapes the HIBP API across many IP addresses when they could just download the original leaked username & password databases?
Theres even a torrent file of all of them I won't link here...
Re: Authentication and the Have I Been Pwned API
#3Who bruteforce scrapes the HIBP API across many IP addresses when they could just download the original leaked username & password databases? Theres even a torrent file of all of them I won't link here...
Torrent file Of ALL leaks?
I usually only see some
And when people ask about a latest leak, others disingenuously reply “just check YOUR email on HIBP what kind of person needs the database”
Re: Authentication and the Have I Been Pwned API
#4Next step, premium access without rate limit?
Re: Authentication and the Have I Been Pwned API
#5Obvious next concern: Will bad actors just scrape the website? Putting authentication and payments in front of that rather defeats the entire point, and without that you're back to rate limiting which is exactly what has just been declared as a failed approach.
Re: Authentication and the Have I Been Pwned API
#6I wish the post made more clear, ideally right at the top, that the new fee applies only to third-party apps that access the HIBP API, not to end users whose email addresses are being checked against the API. You have to read through the post a bit before that becomes clear.
Individual users who just want to figure out whether they've been pwned will not have to pony up the cash. They can still visit https://haveibeenpwned.com and get that information for free.
Re: Authentication and the Have I Been Pwned API
#7I wish the post made more clear, ideally right at the top, that the new fee applies only to third-party apps that access the HIBP API, not to end users whose email addresses are being checked against the API. You have to read through the post a bit before that becomes clear. Individual users who just want to figure out whether they've been pwned will not have to pony up the cash. They can still visit https://haveibee…
Domain wide breach searches for a domain you control still appears to work for free as well.
Re: Authentication and the Have I Been Pwned API
#8Obvious next concern: Will bad actors just scrape the website? Putting authentication and payments in front of that rather defeats the entire point, and without that you're back to rate limiting which is exactly what has just been declared as a failed approach.
Probably.
But you can justify a significantly more restrictive rate limit for a website form intended for individual mortal humans to check their own personal email addresses for breaches.
The API has to support request frequencies for legitimate usage that are obviously exploitable at a sufficiently small scale to attract a few exploiters...
Re: Authentication and the Have I Been Pwned API
#9I wish the post made more clear, ideally right at the top, that the new fee applies only to third-party apps that access the HIBP API, not to end users whose email addresses are being checked against the API. You have to read through the post a bit before that becomes clear. Individual users who just want to figure out whether they've been pwned will not have to pony up the cash. They can still visit https://haveibee…
Perhaps it could be made more clear, but from the post I thought it was very apparent he was only talking about API abuse; most of the introductory text was concerning rate-limiting.
Re: Authentication and the Have I Been Pwned API
#10"After 4 and a bit years, by far and away the most popular method with an uptake of more than 90% is versioning via the URL. So that's all V3 supports. I don't care about the philosophical arguments to the contrary, I care about working software and in this case, the people have well and truly spoken. I don't want to have to maintain code and provide support for something people barely use when there's a perfectly viable alternative."
Well said !