Passbolt: a bold use of HaveIBeenPwned

Introduction

In 2017, Troy Hunt introduced in a blog post a service to allow people to check if a password is known to be already present among the 306 millions of leaked passwords from various breaches.1 Of course, it was not recommended to submit your real password or even a hash of it.

The following year, Junade Ali from Cloudflare proposed a very elegant solution to be able to query the service without revealing too much information.2

[...] …

blog blog post breaches check course hash haveibeenpwned hunt introduction leaked leaked passwords millions passbolt password passwords people real service troy hunt