Have I Been Pwned: Serving billions of requests and terabytes of data without going broke!
summary
Have I Been Pwned’s Pwned Passwords API grows to about 5 billion requests per month and stores ~850 million password hashes (~126 TB transferred if uncached), which would cost >$12,600/month on Azure. The solution uses Cloudflare CDN, Cloudflare Cache Reserve (R2) in front of Azure Blob/Table storage and Azure Functions with URL normalization and pre-compression to preserve Content-Length. After changes cache hit reaches 99.9999%, monthly cost drops to roughly $16.50, a ~99% saving; caveats include CDN item-size limits (15 GB) and the need for cache invalidation.
AI-written summary · about
chapters (19)
- 0:00Start
- 2:02Law enforcement and governments
- 4:27Pwned Passwords API
- 8:09"hunter2" - A short story from IRC
- 8:56"hunter2" example
- 9:41Core Hosting Environment
- 14:45Cloudflare Caching
- 17:01Initial Implementation Results
- 17:39Great success!
- 18:14What happened?
- 22:22New problems
- 23:18How can we get the hit rate back up
- 23:41How does it work?
- 24:22Cache Reserve Requirements
- 25:01The case of the missing Content-Length
- 28:03Compress the response before Azure does!
- 29:51Let's wrap it up!
- 31:39Recap
- 34:38Questions?
related talks
47mHow I Pwned My Cloud Costs
53mAdventures at HyperScale!
50mHave I Been Pwned?
01h 02mI’m Pwned. You’re Pwned. We’re All Pwned
47mLessons From Billions of Breached Records
40mFantastic Passwords and Where to Find Them
54mHave I Been Pwned - A Passkey Journey
31m680,000 Plaintext Passwords: An Open Source Love Story in Three Acts