4 ms·
> on any input (which is hashed and cropped clientside) You could still run a volume analysis on the reply. If it's very short, you can guess it's a 404. If it
by moviuro 9y ago
> on any input (which is hashed and cropped clientside)
You could still run a volume analysis on the reply. If it's very short, you can guess it's a 404. If it isn't, you might be able to get which prefix was queried... \end{tin foil hat}
- jgrahamc 9y agoThat won't work since all possible 5 character prefixes return data.
- moviuro 9y agoThey don't all return the same amount though. According to my Chrome here and now: > https://api.pwnedpasswords.com/range/aaaaa https://api.pwnedpasswords.com/range/aaaaa = 28.8KB > https://api.pwnedpasswords.com/range/01234 https://api.pwnedpasswords.com/range/01234 = 28.5KB > https://api.pwnedpasswords.com/range/af0fa https://api.pwnedpasswords.com/range/af0fa = 23.2KB