3 ms·
Sure, the source they're referencing, with a plaintext torrent, is here: https://hashes.org/leaks.php?id=515 https://hashes.org/leaks.php?id=515 which was last
by prophesi 7y ago
Sure, the source they're referencing, with a plaintext torrent, is here: https://hashes.org/leaks.php?id=515 https://hashes.org/leaks.php?id=515 which was last updated yesterday.
However, this shouldn't be alarming.
1) Attackers already have the plaintext password of these hashes. That's why they're in HIBP's repository in the first place.
2) You should already assume most sites/apps don't have proper security hygiene. Password re-use is what will get you. If you wish to warn your users if they're reusing a password, then HIBP's API should already do well for that.
3) You have truly astronomical odds of generating the same password as one in a leaked database should yours contain enough bits of entropy. Remember that GPU's are making millions of guesses per second in the first place when cracking passwords, and significantly slower if the hashing algorithm protects against GPU attacks.