zlacker

[parent] [thread] 0 comments
1. vagab0+(OP)[view] [source] 2020-06-01 14:49:33
> It’s a service for excluding compromised passwords from use.

How does this work?

2 cases:

1. I know password P is compromised. I check it in HIBP. If compromised, great, but I already know that. If not, well, too bad. I still can't use it because I know it's compromised. - decision doesn't depend on the result of HIBP.

2. I don't know if P is compromised. I check it in HIBP. If compromised, I don't use P. If not, I don't use P because I already put P in a text box connected to the internet. - decision doesn't depend on the result of HIBP.

Don't get me wrong, I'm well aware of the value of HIBP. I'm just arguing about this particular use case.

[go to top]