3 ms·
I figure it’s easy to do something like this by generating a nonce over a TLS connection and using it as a shared salt value, and just checking if the hashes of
by ninkendo 9y ago
I figure it’s easy to do something like this by generating a nonce over a TLS connection and using it as a shared salt value, and just checking if the hashes of the two passwords match when using the nonce as a salt.
Not sure what k-anonymity is but I wouldn’t be surprised if it’s something similar.
Edit: nope, looks like k-anonymity basically lets you search by the first few characters of the sha512 hash, and it responds with all of the hashes that have that as the first few characters, along with the count for each (how many people use that password, likely.)
- eridius 9y agoYeah. It produces a response that’s small, easy and fast to generate, easy and fast to parse, without actually telling the server much of anything (all the server learns is that it isn’t a password whose hash starts with something else, but that barely narrows the search space).
- tonyztan 9y agoDirect link to k-anonymity section: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...