fuhrysteve

Hey HN!

My name is Steve Fuhry, and I'm one of three Co-founders of https://tpastream.com. TPA Stream was founded in 2014 to make health benefits easier for employees and administrators. Users can connect their Health Insurance portals to our backend, and we provide the user's claims data on their behalf to third party applications.

We recently launched TPA Stream Connect, which is The Easiest Way for Users to Connect Their Health Insurance to an App. TPA Stream Connect can be embedded in your website or mobile app using our JavaScript SDK, which allows users to securely submit their credentials to our servers. Once we begin collecting their claims data, it can be immediately sent to your application via Webhooks, empowering you to create experiences and value for your users using their health insurance data.

https://www.tpastream.com/introducing-tpa-stream-connect/

https://developers.tpastream.com

We're excited to see what you build with it!

We have a site with sensitive data on it, and need to verify that when users create a new password that the password has not been previously exposed in a known breach. The way everyone seems to be doing this is by downloading and searching the 10gb haveibeenpwned database for sha1 matches of the candidate password.

We know that it's best practice to keep docker images small, however this seems like a tempting solution for an annoying problem: simply make a 10Gb Docker image that downloads the haveibeenpwned database (which is ~10Gb) as part of the image, and expose a searchable API. Sure it would be slow to deploy an image that large on Kubernetes, but it seems like it'd otherwise be easy to maintain.

How are you checking passwords against haveibeenpwned / similar for your users?