Comment by lioeters
3 days ago
That's not how privacy works. I don't care what you mind or consider harmless, no tool should be scanning the file system for anything without explicit consent and permission.
Making such a behavior opt-out is malicious, intentionally or not. --pwned=false? Give me a fucking break, so you're pwned by default then. Unbelievable what some developers think they can get away with.
Did it scan the file system? Or did users hand over the passwords as part of the application? Because everything else makes it sound like the latter.
The site is called "Have I Been Pwned", thus the cutesy name of the flag...
Perhaps it scans a database and not the file system, but either way, if I see an application gathering passwords and sending remote requests to an unauthorized third party "pwnedpasswords.com" (literally) without my explicit command to do so, then it is acting maliciously by design.
It's a password management system - it's not "gathering" passwords, it is being explicitly given passwords by the user. This is a very important difference! The entire point of the application is that you give it your passwords and it keeps them secure.
The designer felt that "secure" included "is this password already published, online, in a known database breach", which is not an unreasonable interpretation.
The documentation has been clarified. There was a a feature flag. Calling this malicious is just absurd flame-bait.
4 replies →