Top all-time · #15059
Jack Cable
Personal blog · cablej.iosecurityprogramming
Jack Cable's personal blog at cablej.io covers security and programming. Since 2019, 5 different Hacker News readers have linked it 7 times, most often “Attacks on applications of k-anonymity for password retrieval (2019)”. No feed was found, so read it on the site itself.
Jack Cable is a coder turned white-hat hacker, a leader in making government and industry more secure.
Most-linked posts?
- Attacks on applications of k-anonymity for password retrieval (2019)3 people · 4 mentions · first linked 2026-10-17
What Hacker News says?
There are fundamental privacy risks to using the HIBP Pwned Passwords service which should be considered when implementing it. See my writeup here — https://cablej.io/blog/k-anonymity/ . In short, despite claims of protecting privacy, a malicious server can recover user passwords in some cases even if they haven’t previously been compromised.
Comment linking /blog/k-anonymity/
on “Firefox to Warn When Saved Logins Are Found in Data Breaches”Submitted Attacks on applications of k-anonymity for password retrieval (2019) as a story · 2 points
HN discussionHey Frenck, longtime HA user here. I know this feature feels pretty safe but I hope you can give http://cablej.io/blog/k-anonymity/ a read on how this ultimately still puts trust in HIBP, a third party cloud service. In my opinion this might help with understanding why people are rightfully worried, especially when they thought they are running a very local and private HA instance.
Comment linking /blog/k-anonymity/
on “I never authorized an integration that scans my secrets”Submitted Attacks on applications of k-anonymity for password retrieval as a story · 2 points
HN discussionThats the thing though, it's not safe [1] and puts trust in a third party - HIBP. To do that automatically without any notice to the user breaks the fundamental value proposition of a local home assistant which over and over again preaches keeping things local and private. As someone who relies on home assistant every day, I'm quite disappointed to hear Frenck's response to this. [1] http://cablej.io/blog/k-anonymit…
Comment linking /blog/k-anonymity/
on “I never authorized an integration that scans my secrets”As I understand it. There is research published which suggests HIBP type password checking schemes DO give meaningful signal to potential attackers. EG https://d0nut.medium.com/attacks-on-applications-of-k-anonym... and http://cablej.io/blog/k-anonymity/ It is absolutely not OK to participate in this scheme on a users behalf without their affirmative consent. You simply cant know the context of people's situations.…
Comment linking /blog/k-anonymity/
on “I never authorized an integration that scans my secrets”Aside from Filedescriptor's work, here are some of my favourite blogs in the web application security space (not an exhaustive list): - https://blog.orange.tw/ - https://ngailong.wordpress.com/ - https://whitton.io/ - https://sakurity.com/blog - https://homakov.blogspot.com/ - https://buer.haus/ - https://philippeharewood.com/ - https://portswigger.net/research - https://gerbenjavado.com/ - https://medium.com/@intid…
Comment linking /
on “Google YOLO clickjacking (2018)”