2 ms·

> but I was hesitant because adding network calls to a library like this can be a security risk HIBP works by having the client SHA1 hash the password and send

> but I was hesitant because adding network calls to a library like this can be a security risk HIBP works by having the client SHA1 hash the password and send a 5 character hash prefix to the API. What you receive in response is a list of all breached password hashes which you can then compare the full hash against. https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByRange https://haveibeenpwned.com/API/v3#SearchingPwnedPasswordsByR... HIBP never receives the password or the full hash. Did you have any other risks in mind?

Tostino 4y ago
Understood, but imo any network calls at all are a something to raise eyebrows with a library like this, and I figured that would raise the barrier of adoption. I was thinking if people wanted to do that they would integrate both nbvcxz and HIBP api themselves... No specific risks, I was just trying to keep a very low footprint with this library to give little reasons for a security department to tell developers "no, don't use that".