3 ms·
Pwned Passwords[1] is just such a database (with passwords hashed using either SHA-1 or NTLM as an obfuscation measure, and without any emails). Hunt used to di
by mananaysiempre 1y ago
Pwned Passwords[1] is just such a database (with passwords hashed using either SHA-1 or NTLM as an obfuscation measure, and without any emails). Hunt used to distribute versioned snapshots, but these days he directs you to an API scraper[2] in C# instead, so you can still get a list but it probably won’t exactly match anyone else’s.
[1] https://haveibeenpwned.com/passwords https://haveibeenpwned.com/passwords
[2] https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader
- charcircuit 1y agoThis isn't sufficient for all cases. For example a breach could contained a hashed passwords. If you only have the obfuscated passwords of previous breaches you can't hash it yourself to know that the new breach is just a rehash of an existing one. Data breaches can also contain other things than just passwords. Things like phone numbers, addresses, etc that would also be useful for checking.
- anon7000 1y agoPublishing someone’s leaked credentials in plaintext for anyone to look at also isn’t ideal. I mean, yes, it’s been leaked, but we also don’t need to make it easier for someone to get hacked.
- charcircuit 1y agoPretending it's private is also problematic. People get a false impression of what is public and what isn't.