3 ms·
It's easy to check through their verification service if your passwords have been compromised. Hash your password locally $ echo -n fredflinstone | shasum
by andrewla 3y ago
It's easy to check through their verification service if your passwords have been compromised.
Hash your password locally
$ echo -n fredflinstone | shasum
95e47d937e105fa1cc84bfa476b10f091304c090 -
Then take the first five characters of the hash and invoke the API
$ curl https://api.pwnedpasswords.com/range/95e47
...
D8F3BA8D3952AA8917C78295EE1122F675C:17
D910D224A8450006478ED28D2CE2D005343:10
D91C102088F1D91469B803235DB60903259:874
D937E105FA1CC84BFA476B10F091304C090:290
D96BF2796784C142392D8B46AEF68B991D0:4
D98009835A90E46EFFD43AC3E5C6BD1C14B:5
And there we have it -- my password is compromised (the suffix D937...)
Easy enough to script this up with minimal information leakage. All you're sending is 20 bits; that's not enough to do anything malicious even if your password is compromised.
- sambazi 3y agoadd two spaces right before the echo to avoid logging your secrets in the shell history
- andrewla 3y agoOr better, just do a `(read -s asdf; echo -n $asdf | shasum)` to create a temporary subshell and never even expose your password in the shell output.
- sambazi 3y agowill create interesting errors with certain characters
- mzs 3y ago% head -1 | tr -d \\n | shasum Type your username and press the RETURN key.
- codetrotter 3y agoOne space is sufficient in bash, if memory serves right. And secondly, on macOS with the default config for zsh no amount of spaces will help, I think. You have to first configure zsh to ignore from history when starting with space. And after that I think one space will be enough.
- nijave 3y agoThat functionality in bash is controlled by the HISTCONTROL environment variable. Many systems this defaults to "ignorespace" but this isn't always the case. On Fedora, with bash, HISTCONTROL defaults to "ignoredups" and is set by /etc/profile (unless it's changed in the last few years). Usually you can set/unset the shell option "history". For instance, "set +o history" to disable history in the current shell and "set -o history" to turn it back on. Edit, Looks like on Ubuntu HISTCONTROL=ignoreboth comes from .bashrc in /etc/skel/
- sambazi 3y agothanks for the context
- nprateem 3y agoPrefix not suffix
- crossroadsguy 3y agoThis could be baked into BitWarden to be honest. Or is it already? Yeah it seems it's there already https://github.com/bitwarden/clients/issues/523 https://github.com/bitwarden/clients/issues/523