Validating Leaked Passwords with k-Anonymity
Feb 21, 2018Junade Ali
Summary
Cloudflare has contributed to the Pwned Passwords service by designing and implementing API endpoints that support anonymized range queries. This feature allows clients to search for breached passwords using truncated hash prefixes, ensuring that the Pwned Passwords API does not receive the complete unsalted password hash, thereby enhancing user privacy and security. The implementation leverages the k-anonymity principle by grouping hashes into buckets based on their prefixes, enabling clients to perform offline checks.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack