Embed Notice

To follow up on yesterday's discussions about privacy implications of Cloudflare detecting the use of reused passwords in traffic passing through its infrastructure, Cloudflare has disclosed this practice previously. The protocol behind this check, known as Might I Get Pwned (in a nod to @troyhunt), was described in a 2022 Usenix paper called Might I Get Pwned:
A Second Generation Compromised Credential Checking Service. It devises what it claims is a privacy-preserving way to check for credential reuse. It involves comparing hashes. Cloudflare says passwords are never logged.

I'm home recovering from a Covid infection, so I don't have the energy to dig into this any deeper right now. I am interested in responses from people qualified to evaluate the privacy-preservation claims, including @benjojo @cR0w @Viss and @matthew_d_green

Relevant links:

https://arxiv.org/pdf/2109.14490

https://blog.cloudflare.com/helping-keep-customers-safe-with-leaked-password-notification/

https://blog.cloudflare.com/privacy-preserving-compromised-credential-checking/