4 ms·
The HIBP database really should be open to the world, with the email being redacted. I would love to grep the list of 25m passwords to see if any of mine are i
by lelanthran 3y ago
The HIBP database really should be open to the world, with the email being redacted.
I would love to grep the list of 25m passwords to see if any of mine are in there.
I don't particularly want to send my details to HIBP to check if I have been compromised.
- phpisthebest 3y agoYou can download the password hashes. https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
- hennell 3y agoThey have a downloader for the hashed password list: https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader
- diggan 3y agoAny ideas what the final size on disk would be after downloading?
- oldprogrammer2 3y agoIt is 37 GB (I downloaded it yesterday).
- samstave 3y agoObligatory H2: Can you see if my passwd is in there ***?*
- bookofjoe 3y agoAsking for a friend
- denysvitali 3y agoLooks like hunter2 to me
- TacticalCoder 3y agoIs it 37 GB with these new 1/3rd of previously unknown passwords hashes added? So basically: did that DB grow from about 27 GB to 37 GB in the last few days?
- thesuitonym 3y agoWhy does this need to be an app? Why not just release the hashes?
- CodesInChaos 3y agoThe hashes are split into a million (2^20) files based on the first 20 bits (5 hex characters) of the hash. The downloader is just a convenient way to download them all. The urls are https://api.pwnedpasswords.com/range/00000 https://api.pwnedpasswords.com/range/00000 to .../FFFFF, downloadable via any http client.
- nighthawk454 3y agoThanks, TIL! Bet JDownloader can make quick work of that as well
- deleted 3y ago[deleted]
- rad_gruchalski 3y agoYou can just host it yourself: https://github.com/radekg/hibp https://github.com/radekg/hibp.
- justinclift 3y agoIt's a .NET application, so may be windows only. :/
- jimbobimbo 3y ago.NET 6+ is cross platform.
- justinclift 3y agoIsn't that just specific parts, rather than the whole thing?
- daveoc64 3y agoThe core of the .NET runtime is cross-platform. You do have the option to use platform-specific APIs or frameworks, which will make your app only work on that platform. In the case of this app, it doesn't use anything platform-specific, so it could run on Windows, Linux and macOS.
- deleted 3y ago[deleted]
- jjulius 3y agoAs mentioned in the article, the database has been uploaded with emails redacted to Troy's Pwned Password search on haveibeenpwned.
- fritzo 3y agoThey should offer a small Bloom filter for download.
- andrewla 3y agoIt's easy to check through their verification service if your passwords have been compromised. Hash your password locally $ echo -n fredflinstone | shasum 95e47d937e105fa1cc84bfa476b10f091304c090 - Then take the first five characters of the hash and invoke the API $ curl https://api.pwnedpasswords.com/range/95e47 ... D8F3BA8D3952AA8917C78295EE1122F675C:17 D910D224A8450006478ED28D2CE2D005343:10 D91C102088F1D91469B803235DB60903259:874 D937E105FA1CC84BFA476B10F091304C090:290 D96BF2796784C142392D8B46AEF68B991D0:4 D98009835A90E46EFFD43AC3E5C6BD1C14B:5 And there we have it -- my password is compromised (the suffix D937...) Easy enough to script this up with minimal information leakage. All you're sending is 20 bits; that's not enough to do anything malicious even if your password is compromised.
- sambazi 3y agoadd two spaces right before the echo to avoid logging your secrets in the shell history
- andrewla 3y agoOr better, just do a `(read -s asdf; echo -n $asdf | shasum)` to create a temporary subshell and never even expose your password in the shell output.
- sambazi 3y agowill create interesting errors with certain characters
- mzs 3y ago% head -1 | tr -d \\n | shasum Type your username and press the RETURN key.
- codetrotter 3y agoOne space is sufficient in bash, if memory serves right. And secondly, on macOS with the default config for zsh no amount of spaces will help, I think. You have to first configure zsh to ignore from history when starting with space. And after that I think one space will be enough.