Have I Been Pwned to go open source – 10bn credentials, not so much, says creator Hunt
- Reference: 1596825550
- News link: https://www.theregister.co.uk/2020/08/07/hibp_open_source/
- Source link:
The site, at the time of writing, hosts details of roughly 10 billion hacked accounts from 473 separate websites. You input your email address and HIBP tells you whether or not the address features in its database of credentials known to have been stolen by hackers from sites.
In a blog post Hunt [1]explained his thinking, referring to an [2]aborted potential sale of the site earlier this year .
“I've been giving a great deal of thought to how I want this project to evolve lately, especially in the wake of the M&A process that ended earlier this year right back where I'd started: with me being solely responsible for everything,” he wrote.
“The single most important objective of that process was to seek a more sustainable future for HIBP and that desire hasn't changed; the project cannot be solely dependent on me.”
Have I Been S0ld? No, trusted security website HIBP off the table, will remain independent [3]READ MORE
In brief, if Hunt was hit by a bus tomorrow HIBP would “wither and die” he said. With so many people relying on it for breach notifications, he realised that there was only one thing to do.
“The philosophy of HIBP has always been to support the community, now I want the community to help support HIBP,” he continued. “Open sourcing the code base is the most obvious way to do this. It takes the nuts and bolts of HIBP and puts them in the hands of people who can help sustain the service regardless of what happens to me.”
Hunt is completely open about who he is and how he operates HIBP, which means the entire basis of the site’s successful operation rests on trusting him and anyone he grants access to the site’s backend to. Previously he had explored selling HIBP, though he halted the process after a “change in business model” meant he was no longer confident that a sale of the site would be the right thing to do for the wider community.
However, the weight of responsibility has sat heavily on the man’s shoulders: Hunt previously shared that maintaining the site solo had brought him “very close to burn-out” and he has repeatedly looked for ways to spread the burden. Open-sourcing the code that powers the site appears to be the most publicly transparent way to do that without flogging 10 billion login credentials to some corporate overlord.
The open-sourcing won’t be immediate; in his blog post Hunt said some trusted confidantes have access to the source code for now to clean it up and help prepare the site to go full public, rather than just chucking it onto Github or similar. As he put it, these are “above all, people I trust to expose my own shortcomings so that they can help me make this thing more sustainable.”
As for the data itself, Hunt expressed the intention to ensure that strong privacy controls are still applied even as the framework of HIBP’s code is made “more transparent.” “There are literally billions of people that have been impacted by data breaches,” he said. ®
Get our [4]Tech Resources
[1] https://www.troyhunt.com/im-open-sourcing-the-have-i-been-pwned-code-base/
[2] https://www.theregister.com/2020/03/03/have_i_been_pwned_no_longer_being_sold/
[3] https://www.theregister.com/2020/03/03/have_i_been_pwned_no_longer_being_sold/
[4] https://whitepapers.theregister.com/
At the core, sure, but he has other systems tied into it (password checker and API, for instance). I imagine it's not too complex, but the dust that collects on a personal project is high, as is the anxiety/embarrassment of showing off your dirty underwear. I personally understand wanting to have trusted people look first.
* cautiously eyes own private repos *
Fair comment. I also don't see why the sale needs to include any stolen credentials in a useful form. Hash the mail addresses and only publish the hashes. It wouldn't change the ability for the site to tell you if you've been pwned or not.
As to finding anyone trustworthy and dedicated enough to run, maintain and most importantly, update the site that Troy created so that it retains its reputation is probably the hardest part of trying to pass it on.
I'd say that some things people create on the Internet are much like children: once you have given them life, you have an inherent responsibility for them. This responsibility may include giving them accommodation at a hotel (your house) for many more years than you may have expected!
The only hope I'd see for the site is if a truly independent non-profit organisation with the right competence and drive offered to take it over. EFF comes to mind as they already publish quite a few tools to help people avoid some of the more common dangers on the Internet. This kind of resource should be right up their street.
In fairness, it's not exactly the most complex codebase in the universe. You got a list of compromised credentials A. A list of people subscribed to tell you when their email appears in a list of compromised credentials B. When new intersections of A and B appear, send an email saying 'you've been pwned'. If it's more complex than that, he's doing something majorly wrong.