Re:Pwned passwords, open source in the .NET foundation and w...
by jffry on Saturday May 29, 2021 @08:44AM
(#27324893)
Troy Hunt has blogged a few times about the legitimacy of his service, and it's clearly been a carefully walked path to where it is today.
I think ultimately it comes down to the fact that he's not redistributing the lists of emails, and he doesn't retain pairs of (email + password hash). He designed the site to provide two useful queries ("what breaches included my email" and "has this password been seen in any breaches you processed"), which strike a responsible balance between disclosure and privacy.
Moreover, he has written about his intentions and acted with a fair deal of transparency, which is a strong contrast to some of the shady behavior you'll see from people dancing in the gray areas of the law.
That was probably a stepping stone to partnering with other organizations, which has snowballed into having the cooperation of the FBI, as well as the endorsement of multiple countries' governments.
I think ultimately it comes down to the fact that he's not redistributing the lists of emails, and he doesn't retain pairs of (email + password hash). He designed the site to provide two useful queries ("what breaches included my email" and "has this password been seen in any breaches you processed"), which strike a responsible balance between disclosure and privacy.
Moreover, he has written about his intentions and acted with a fair deal of transparency, which is a strong contrast to some of the shady behavior you'll see from people dancing in the gray areas of the law.
That was probably a stepping stone to partnering with other organizations, which has snowballed into having the cooperation of the FBI, as well as the endorsement of multiple countries' governments.