There’s no perfect solution here: publish the raw data, and people who haven’t c... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

1f60c on Aug 7, 2020 | parent | context | favorite | on: I'm Open Sourcing the Have I Been Pwned Code Base

There’s no perfect solution here: publish the raw data, and people who haven’t changed their passwords get cracked, or publish hashed (in some way) passwords, and people will crack the passwords themselves. (That said, I guess most crackers will just get the data straight from the source, but still.)

speedgoose on Aug 7, 2020 | [–]

He does publish the passwords hashed, with the number of times each password was leaked (without salt and the weak sha1).

nnt38 on Aug 9, 2020 | | [–]

It is trivial to find (most) of the datasets HIBP uses

toomuchtodo on Aug 7, 2020 | [–]

Incorporate a non profit and have it own the data and run the service? No different than Let's Encrypt.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact