4 ms·
>If a password is not found in the Pwned Passwords set, it'll result in a response like this: Wait, so I test my password to see if it's "good" and now you hav
by excitom 9y ago
>If a password is not found in the Pwned Passwords set, it'll result in a response like this:
Wait, so I test my password to see if it's "good" and now you have a copy of a password I will be using. Am I just being paranoid?
- joatmon-snoo 9y agoThis is Troy we're talking about - I strongly doubt he'd do anything like that without full disclosure.
- thephyber 9y agoI think the point of gp is to say that once you submit your password, you have no control of where it goes. Maybe a malicious copy of the website exists at lots of LevenshteinDist=1 domains. Accidentally typo the domain and get pwned, thinking you are submitting it to an ethical security researcher's tool, but actually getting phished.
- mnem 9y agoFrom the article: "It goes without saying (although I say it anyway on that page), but don't enter a password you currently use into any third-party service like this! I don't explicitly log them and I'm a trustworthy guy but yeah, don't."
- rrauenza 9y agoYou can post the sha1sum instead. $ sha1sum SooperSekretPassw0rd^D SooperSekretPassw0rddc0d3504b259a92dce59b850969601d12c06a75f -
- deleted 9y ago[deleted]
- 13of40 9y agoIf you're on Windows, you can calculate it in PowerShell like this: $password = "foobar" ([Security.Cryptography.SHA1CryptoServiceProvider]::Create().ComputeHash([Text.Encoding]::ASCII.GetBytes($password)) | %{'{0:x2}' -f $_}) -join ""
- Spivak 9y agoAnd people say that PowerShell isn't readable or intuitive.
- 13of40 9y agoYou can also do it like this: "foobar" | Out-File password.txt -Encoding ASCII -NoNewline Get-FileHash password.txt -Algorithm SHA1 del password.txt That's readable and intuitive, but the downside is it puts your password in a file.
- AlexCoventry 9y agosha1sum is giving different results. /tmp$ echo "p@55w0rd" | sha1sum 8633c4a8b38a8826132414d8861af7b6a8371976 - This is a different value from the one given in the blog post: "ce0b2b771f7d468c0141918daea704e0e5ad45db". The python sha-1 hexdigest comes out right, though: In [13]: import sha In [14]: sha.new('p@55w0rd').hexdigest() Out[14]: 'ce0b2b771f7d468c0141918daea704e0e5ad45db' In case anyone else has passwords they want to check, this will binary-search them: https://gist.github.com/coventry/5df7885fb0d5caeabb39fcd0e2bf4864 https://gist.github.com/coventry/5df7885fb0d5caeabb39fcd0e2b...
- nsillik 9y agoYou need to use `echo -n` in order to not have `echo` generate a newline.
- AlexCoventry 9y agoAh, thanks.
- mrob 9y agoYou can also binary search with "look -b". The version included with Debian Unstable doesn't support large files, but it will search multiple files at once, so you can split without breaking lines, eg. with "split -C 1999m", and search with "look -b SHASUM splitfile*".
- AlexCoventry 9y agoThanks, I knew there had to be an easier way, but couldn't find it.
- rrauenza 9y agoMake sure you clean your .history if you're using echo to pipe the password...
- AlexCoventry 9y ago