3 ms·
On the note of entropy, and checking for a breach at the same time... I have been toying with the idea of adding hibp api support to Nbvcxz which would give an
by Tostino 4y ago
On the note of entropy, and checking for a breach at the same time... I have been toying with the idea of adding hibp api support to Nbvcxz which would give an integrated solution for ensuring you aren’t storing weak or already leaked passwords (hashed) in your system...but I was hesitant because adding network calls to a library like this can be a security risk.
I may just try and implement and see what it looks like.
- dns_snek 4y ago> but I was hesitant because adding network calls to a library like this can be a security risk HIBP works by having the client SHA1 hash the password and send a 5 character hash prefix to the API. What you receive in response is a list of all breached password hashes which you can then compare the full hash against. https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByR... HIBP never receives the password or the full hash. Did you have any other risks in mind?
- Tostino 4y agoUnderstood, but imo any network calls at all are a something to raise eyebrows with a library like this, and I figured that would raise the barrier of adoption. I was thinking if people wanted to do that they would integrate both nbvcxz and HIBP api themselves... No specific risks, I was just trying to keep a very low footprint with this library to give little reasons for a security department to tell developers "no, don't use that".