3 ms·

Apparently most of the SHA1 hashes of haveibeenpwned passwords were cracked about a year ago: https://blog.cynosureprime.com/2017/08/320-million-hashes-exposed

Apparently most of the SHA1 hashes of haveibeenpwned passwords were cracked about a year ago: https://blog.cynosureprime.com/2017/08/320-million-hashes-exposed.html https://blog.cynosureprime.com/2017/08/320-million-hashes-ex... I wonder if segments of the list are around to create a password-blacklist edit: previous discussion https://news.ycombinator.com/item?id=16799826 https://news.ycombinator.com/item?id=16799826

prophesi 7y ago
Sure, the source they're referencing, with a plaintext torrent, is here: https://hashes.org/leaks.php?id=515 https://hashes.org/leaks.php?id=515 which was last updated yesterday. However, this shouldn't be alarming. 1) Attackers already have the plaintext password of these hashes. That's why they're in HIBP's repository in the first place. 2) You should already assume most sites/apps don't have proper security hygiene. Password re-use is what will get you. If you wish to warn your users if they're reusing a password, then HIBP's API should already do well for that. 3) You have truly astronomical odds of generating the same password as one in a leaked database should yours contain enough bits of entropy. Remember that GPU's are making millions of guesses per second in the first place when cracking passwords, and significantly slower if the hashing algorithm protects against GPU attacks.