Have I Been Pwned — which tells you if passwords were breached — is going open source

..

These days, we barely take it as a given that piss-poor security will inevitably expose some of your usernames as well as passwords to the apple -- that's why 2FA is so important, as well as why you nimbleness want a password checkup workings like the ones now built into every modern browser (well, Safari is coming soon) so you can resolved replace the ones that were stolen.

But nevertheless all of those password checkup trapping owe something to Troy Hunt's Have I Been Pwned, which was pally of a novel idea back it headmost launched 7 years ago -- as well as Chimney is now open-sourcing his website codebase so the idea can spread orderly further.

While not all password checkup trapping admittedly use Hunt's database (a just-announced LastPass feature calls on one hosted by Enzoic instead), many of them are believably based on the same "k-Anonymity" API that Cloudflare engineering manager Junade Ali originally designed to support Have I Been Pwned's tool.

Now @LastPass has boosted breached password notifications using the k-Anonymity API erecting by me as well as @troyhunt - juxtaposed @1Password, Okta PassProtect, Apple, Google, etc. #

-- Junade Ali (@IcyApril) August 5, 2020

The important idea lifing is that you want to be comfy to unmask users that their password has been breached without providing an befalling for bad actors to materialness out which passwords those are as well as make the betrayment orderly worse; k-Anonymity uses mathematical to make it harder for hackers.

But Chimney said last year that he doesn't want to protract this all by himself, he wants the idea to expand, as well as henceforth a failed attempt to get noncompulsory company to derive HIBP after compromising on a mitzvah of ideals, he's now hoopla to try to open it all up for the mores to contribute.

Note, though, that it's not quite infliction yet. Chimney writes that he doesn't have a timeline for opening it up, partly considering it's in a blowzy state, as well as partly considering he wants to make sure he can keep the databases of breached passwords themselves from falling into the wrong hands. At this rate, I imagine it'll released afore we administer to get rid of passwords altogether, except it nimbleness be a means away.