News for hackers. Stuff that matters.

A comment on Firefox to Warn When Saved Logins Are Found in Data Breaches. Parent comment

Re:Firefox to Warn When Saved Logins Are Found in Data Breaches by EGreg on Wednesday July 17, 2019 @03:30PM (#20463132)
Wait, WHAT?

Troy’s site asks you to send passwords? Not just login identifiers like an email or username?

In that case, you should AT LEAST be sending a hash of a password, a very key-strengthened hash (like sha2 done 1000 times) and on his side Troy can see if it matches anything.

[ Parent | on HN ]
Re:Firefox to Warn When Saved Logins Are Found in Data Breaches by DjangoReinhardt on Wednesday July 17, 2019 @03:44PM (#20463241)
Yeah, that's what HIBP does. See here: https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...

I really feel Troy has handled HIBP very, very carefully, honestly, and with the utmost transparency so far. He seems to have put in a lot of thought into everything - whether it is rolling out a feature or planning the future of HIBP.

[ Parent | on HN ]
Re:Firefox to Warn When Saved Logins Are Found in Data Breaches by DuskStar on Wednesday July 17, 2019 @06:02PM (#20464499)
To clarify for the GP: HIBP sends the first handful of characters of the password hash to the server, not the password itself or even the full hash. The server then returns all of the hashes matching that prefix, and the remainder of the comparison is done client side.
[ Parent | on HN ]