3 ms·
Each time a breach like this happens I want to download the file and check if 1. My emails are in the dataset, and 2. Any of my passwords are in that dataset.
by lelanthran 3y ago
Each time a breach like this happens I want to download the file and check if
1. My emails are in the dataset, and
2. Any of my passwords are in that dataset.
I really just want the collection of passwords so that I can use it as a check against any of my current passwords.
[EDIT: I know about haveibeenpwned.com; I'm not asking for a service that I send a http request to to determine if a single username exists in the db, I want the db itself so I can chuck it into sqlite and check multiple records at a single time, quickly, for both usernames alone and passwords alone
I also believe it's a bad idea to ask a third-party to perform the check. Even if you trust that third-party now, there is no way to ensure that trust in the future - i.e. it gets bought, breached or pwned itself in the future and best case scenario is that the record of your username lookup is available as "confirmed". Without visiting that site, no one would never know if that record was a throwaway or not.]
- hnlmorg 3y agoServices already exist that does this. Some password managers will check but the popular service often talked about on here is https://haveibeenpwned.com/ https://haveibeenpwned.com/
- lelanthran 3y agoThank you, I've edited my comment to be more specified
- GoblinSlayer 3y agoThey used to publish a torrent with hashes, but then went full SaaS.
- hnlmorg 3y agoDownload Have I Been Pwnds dataset then: https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader
- imposterr 3y agoIf you use any of the better password managers this feature exists and runs automatically. If you don't want to go that route, then you can make use of https://haveibeenpwned.com/ https://haveibeenpwned.com/
- lelanthran 3y agoThank you, I've edited my comment to be more specified
- slashtab 3y agoI have a gmail account which google one shows, it along with a username has been leaked on dark web, but haveibeenpwned shows email was not found in any data breach. How is that possible?
- michaelbuckbee 3y agoThey're using different data sources.
- GarrickDrgn 3y agoHIBP lets you download their hashed passwords DB to check against. https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader
- m463 3y agoI agree - download all the passwords and don't single out what you're checking for someone else to see. I don't know why we can't use this kind of thing for better privacy everywhere. A similar example (outside the realm of passwords) would be when checking for a software update. Instead of sending "i have software xyz version 1.2.3", just download a current list of software and check it locally against your software. Probably would be faster anyway to download a static dataset instead of hitting a remote database.
- shapefrog 3y agoEach time a breach like this happens I want to download the file and check if; 1. People on my s*t list are in the dataset, and 2. Any of their passwords are in that dataset. Then I can use the information to make their lives miserable.