Comment by karlgkk
3 days ago
in defense of frenck, this is actually a very secure way to perform the task. swiss cheese alignment won't happen because of this
however
it's also a feature transmitting information in a product that bills itself as being offline. imo it's a (minor) privacy violation, not a security violation.
> swiss cheese alignment won't happen because of this
This is the problem. You do not know what you do not know. There have already been papers written about the problems with HIBP. You don't have to understand the threat model for it to exist.
It's a trust violation.
Yes, that is different than a security violation. This is a privacy (trust) violation.