It has been for many years that 'Have I Been Pwned?' or 'HIBP' provides a way for people to check whether their personal data bas been compromised by data breaches.
Created by security expert Troy Hunt, HIBP first went only in December 4, 2013, with only five data breaches indexed: Adobe Systems, Stratfor, Gawker, Yahoo! Voices, and Sony Pictures. And by putting everything into one place, HIBP allows its users to search for their own information by entering their username or email address.
Fast forward, HIBP collects and analyzes hundreds of database dumps.
As of June 2019, HIBP's website has more than a hundred thousand daily visits, about three million active email subscribers and a database of records that contain almost eight billion accounts.
it was at that time, that Hunt first announced his plans to sell HIBP, saying that he wanted to reduce his personal stress, and hoping that the site can expand beyond what he was able to ever accomplish by himself.
However, in May 2021, Hunt said that he is putting HIBP as an open-source project on GitHub under the BSD 3-Clause license.
He started planning to open-source HIBP in August 2020. In a blog post at the time, he said that:
"What I didn't know is how non-trivial it would be for all sorts of reasons you can imagine and a whole heap of others that aren't immediately obvious. One of the key reasons is that there's a heap of effort involved in picking something up that's run as a one-person pet project for years and moving it into the public domain."
"I had no idea how to manage an open-source project, establish the licensing model, coordinate where the community invests effort, take contributions, redesign the release process, and all sorts of other things I'm sure I haven't even thought of yet."
"This is where the .NET Foundation comes in."
Hunt explained he's open-sourcing the code because "the philosophy of HIBP has always been to support the community, now I want the community to help support HIBP."
Hunt is making sure that HIBP collects data from all the many personal security breaches that happen every week or two.
And with HIBP seeing at least 1 billion requests per months, Hunt can use all the help he can get.
I’m very happy to announce that @haveibeenpwned’s Pwned Passwords is now open source under the @dotnetfdn. Now we’ve got some work to do: building an ingestion pipeline for new passwords provided by the @FBI on an ongoing basis. This is super cool https://t.co/iM17zemmwE
— Troy Hunt (@troyhunt) May 27, 2021
Going forward as an open-source project, HIBP is also receiving compromised passwords discovered in the course of FBI investigations.
"And so, the FBI reached out and we began a discussion about what it might look like to provide them with an avenue to feed compromised passwords into HIBP and surface them via the Pwned Passwords feature," Hunt wrote in a blog post.
"We are excited to be partnering with HIBP on this important project to protect victims of online credential theft. It is another example of how important public/private partnerships are in the fight against cybercrime," as explained by Bryan A. Vorndran, FBI's Assistant Director for Cyber Division.
FBI wants to provide HIBP with passwords, hashed using SHA-1 and NTLM, as HIBP doesn't need them in plain text.
The data the FBI is giving HIBO, will be fed directly into its system, and this is done through Pwned Passwords, in order to let the data flow easily into HIBP.
And with HIBP being an open-source project, Hunt hopes "that this encourages greater adoption of the service both due to the transparency that opening the code base brings with it and the confidence that people can always 'roll their own' if they choose. Maybe they don't want the hosted API dependency, maybe they just want a fallback position should I ever meet an early demise in an unfortunate jet ski accident. This gives people choices."
Hunt admits that thus is a work in progress.
"I don't have all the answers on how things will proceed from here."
