Skip to content

Instantly share code, notes, and snippets.

@sebeard
sebeard / credential-safety.md
Last active June 26, 2019 06:44
Rough outline for an FAQ page about checking passwords against HIBP

Credential Safety - Learn More

What is Credential Stuffing?

Credential Stuffing is a form of cyber attack. The attacker obtains a collection of previously breached credentials (i.e. username & password pairs), and uses this collection to target an organisation. The attack involves trying credentials within the collection against the organisation's login systems in an attempt to gain access to user accounts. The idea being that if a credential has been reused in multiple places, a leaked credential from one organisation can gain access into a user account in another organisation. Attackers commonly use collections like these when attempting to breach accounts to gain access to sensitive data including Personal Identifiable Information, and Payment Card Information.

What is Have I Been Pwned?

Have I Been Pwned (HIBP) is a free online service that documents known data breaches. The service is able to identify if the email address you commonly use has been seen in a publicl

Keybase proof

I hereby claim:

  • I am sebeard on github.
  • I am sebeard (https://keybase.io/sebeard) on keybase.
  • I have a public key whose fingerprint is B82D AFD4 9DD4 A2CF 2D8F 58CE 3CA0 BA10 A7AB 5D78

To claim this, I am signing this object: