Troy Hunt has released the source code for the compromised password checking service 'Have I Been Pwned?' (haveibeenpwned.com), which checks against a database of 11.2 billion accounts stolen in the hacks of 538 sites. Initially, the intent to release the project's code was announced last August, but the process was delayed and the code has only been published now. The service’s code is written in C# and released under a BSD license. The project is planned to be developed with community involvement under the auspices of the non-profit organization .NET Foundation.
At the same time, a partnership has been announced between the HaveIBeenPwned project and the Federal Bureau of Investigation (FBI) of the United States, which expressed its willingness to provide information about compromised passwords identified in the course of ongoing investigations. For example, in the fight against botnets, the FBI often encounters password databases used in malware for conducting attacks. The interest in transferring information to the HaveIBeenPwned service is linked to the desire to have a single point for checking compromised accounts. Password information is planned to be transferred in the form of SHA-1 and NTLM hashes. A special API will be developed to organize an automated channel for transferring passwords.
Source: opennet.ru
