Thread by @troyhunt

I’m very happy to announce that @haveibeenpwned’s Pwned Passwords is now open source under the @dotnetfdn. Now we’ve got some work to do: building an ingestion pipeline for new passwords provided by the @FBI on an ongoing basis. This is super cool 😎 troyhunt.com/pwned-password…

There’s so much I love about this, starting with the fact that it removes a huge barrier for many orgs considering using Pwned Passwords: if I have an unfortunate jet ski related accident and can no longer run the service, you can pick it up and run it yourself.

And because all the passwords are already freely downloadable from @haveibeenpwned, all the data is already in the public domain. Open sourcing the code compliments the already open sourced data.

Next, I hope it also gives people more confidence in what happens when you search the service for a password (or at least a hash prefix). What happens in @cloudflare (their worker is now open source too) and then what happens in @Azure. It’s super, super simple 🙂

Because I really don’t know what I’m doing running an open source project, the @dotnetfdn has been absolutely invaluable. I love what they they do and what their mission is and with friends like @clairernovotny running it, I’ve got complete confidence they’ll be awesome.

And the @FBI bit: imagine having access to more real world passwords as they’re found in the course of investigations and then being to immediately do something good with them. This will be massively beneficial for orgs running services targeted by credential stuffing attacks.

This is just cool from top to bottom 😎 It hasn’t been easy and it’s taken a lot of effort just to get to the point where all this is possible, I’m really excited to see where it goes from here 😊