4 ms·

I recently wrote a small tool to download the whole password database from HIBP and turn it into a Bloom filter that can be used from Golang or Python. The too

I recently wrote a small tool to download the whole password database from HIBP and turn it into a Bloom filter that can be used from Golang or Python. The tool also includes a webserver that lets you check for plaintext password matches (only recommended over a secure network) and SHA1 values: https://github.com/adewes/have-i-been-bloomed https://github.com/adewes/have-i-been-bloomed The filter is about 1.7 GB in size with a 10e-6 false positive rate, so it can be used even on moderate hardware to check user passwords against the database (the entire filter must be loaded into memory currently, though it would be possible to use a memmapped file).

amelius 8y ago
https://www.reddit.com/r/Jokes/comments/1v4bpa/passwords/ https://www.reddit.com/r/Jokes/comments/1v4bpa/passwords/
throwawaymath 8y ago
You don't need to download them from HIBP. You can freely download all major breach databases from databases.today. There really aren't many passwords not represented in those databases which are present in others, but for everything else you can just automatically download grab dumpmon like Hunt does. Also, try google dorking site:vk.com/doc and "@gmail.com"...there are many large password and email databases you can find that way which have not been publicized. This includes many which are not in HIBP. I've tried to call attention to this before but there isn't an active effort to crawl these. Once you download, normalize and deduplicate the entire corpus of password databases, you can find matches in real time for e.g. signup requests.