3 ms·
I don't get it. >Do not send any password you actively us to a third-party service - even this one. So I can only test password that I am not using (and by ex
by jaclaz 9y ago
I don't get it.
>Do not send any password you actively us to a third-party service - even this one.
So I can only test password that I am not using (and by extension that I am not going to use in the future).
>oh no - pwned!
>This password has previously appeared in a data breach and should never be used. If you've ever used it anywhere before, change it immediately!
If I cannot (shouldn't) submit any password I am actively using, what does it matter if I used it before?
Now I already changed it.
- model_m_warrior 9y agoI believe the idea is to ensure no one can use the listing to brute force.
- thephyber 9y agoI think gp is complaining that the second you type your password into the form, you've "used it", hence you should change it. The gp makes a good point, but that's also why you can submit the `sha1($your_password)` instead. The only question is why did Troy allow un-hashed passwords to be submitted.
- jaclaz 9y agoMaybe - even better - if you could submit only - say - first 8 characters of the SHA1 (and NOT the complete hash) and provide - still say - max 10 "whole" hashes found with that 8 char beginning (if more than 10 ask for a ninth char). I mean, here is the SHA1 of my password (not really): d012f68144ed0f121d3cc330a17eec528c2e7d59 This site: https://hashkiller.co.uk/sha1-decrypter.aspx https://hashkiller.co.uk/sha1-decrypter.aspx >We have a total of just over 312.072 billion unique decrypted SHA1 hashes since August 2007. Took exactly 221 ms to reverse it to "pippo".