6 ms·
https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
by junon 11mo ago
https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
- ekjhgkejhgk 11mo ago[flagged]
- jolmg 11mo ago> Passwords are protected with an anonymity model, so we never see them (it's processed in the browser itself), but if you're wary, just check old ones you may suspect. That could mean one might be able to disconnect from the internet while checking.
- ekjhgkejhgk 11mo agoNo, it doesn't mean that, that's ridiculous. How would that work? Magic?
- deleted 11mo ago[deleted]
- bobmcnamara 11mo agoDownload all the hashes first - not practical.
- zahlman 11mo agoThe above post https://news.ycombinator.com/item?id=45840724 https://news.ycombinator.com/item?id=45840724 links to 71.3 KiB of data; since it's a 5-nybble prefix (20 bits) we may easily estimate a size of 71.3 GiB assuming that's a representative sample. Not unfeasible nowadays, but it seems you do have to make separate requests and would presumably be rate-limited on them. If you only download the hash pages corresponding to passwords you hold, even supposing that everything else is fully compromised, an attacker would have to reverse a couple thousand SHA-1 hashes, dodge hash collisions, and brute-force with the results (yes, yes: arson, murder and jaywalking) to pwn you.
- WorldMaker 11mo agoIt's more practical than you may think. Just needs about 40 GBs right now. I did it a couple years back in a fit of peculiar paranoia, downloaded the full hash list and checked all my KeePass-stored passwords at that time against it. https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader
- sunaookami 11mo agoHaveIBeenPwned has been around for ages and it does not send your password to the server - you can check it with the browser console. It hashes it, sends a range of the hash to the server, server replies with a list of hashes that match that range and it's checked locally for a match.
- smokel 11mo agoStill, I would not trust that. The password could be leaked through other means, for example by setting a timer, and exfiltrating fragments of it across future requests. The website loads some external fonts and spits out many warnings in the console by default. Does not instill confidence in the truly paranoid hacker.
- turnsout 11mo agoYou can check it yourself by looking up the hash prefix and searching for your hashed password.
- TZubiri 11mo agoThat level of care is warranted, but you'll find that you are given the tools to audit and it will pass.
- drexlspivey 11mo agoYou can hash yourself and check against the api with 5 lines of python
- bobmcnamara 11mo agoMan, there's a ton of non-obvious ways they could exfiltrate that. I'm not going to read their code.
- MattSteelblade 11mo agoYou can check against the API with just the first characters of your hashed password (SHA-1 or NTLM), for example: https://api.pwnedpasswords.com/range/21BD1 https://api.pwnedpasswords.com/range/21BD1 or you can download the entire dataset.
- zahlman 11mo agoSecond line I already notice: > 000F6468C6E4D09C0C239A4C2769501B3DD:5894 ... Does the 5894 mean what I think it does?
- esnard 11mo ago5894 means that the password appeared 5894 times in the dataset. 5894 is not the password associated with the hash.
- red369 11mo agoI remember when I was searching the file for some passwords my friends and family use, it took me a while to work out that number too. There are some passwords that many people seem to independently come up with and think must be reasonably secure. I suppose they are to the most basic of attacks.
- ekjhgkejhgk 11mo agoHow can you download the entire dataset?
- red369 11mo agoI was going to provide my passwords to any random person on the internet, Troy Hunt might be close to the top of the list, but I think your sentiment is sensible. I remember searching the dataset being fairly straight forward. It's been a while since I've done it, but I think I just downloaded the text file and then grepped it for hashes of my passwords, but I see people doing much more useful things: https://medium.com/analytics-vidhya/creating-a-local-version-of-the-haveibeenpwned-password-database-with-python-and-sqlite-918a7b6a238a https://medium.com/analytics-vidhya/creating-a-local-version...
- Thorrez 11mo agoYou can download all the hashes and check against them locally. https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader
- AlienRobot 11mo agomy password: 2,408 password: 46,628,605 your password: 609 good password: 22 long password: 2 secure password: 317 safe password: 29 bad password: 86 this password sucks: 1 i hate this website: 16 username: 83,569 my username: 4 your username: 1 let me login: 0 admin: 41,072,830 abcdef: 873,564 abcdef1: 147,103 abcdef!: 4,109 abcdef1!: 1,401 123456: 179,863,340 hunter2: 50,474 correct horse battery staple: 384 Correct Horse Battery Staple: 19 to be or not to be: 709 all your base are belong to us: 1
- zahlman 11mo ago> all your base are belong to us: 1 Only 1, really?
- Sohcahtoa82 11mo agoBecause of the spaces. Without spaces, it's 681.
- e12e 11mo agoPassword2020: 109,729 Edit: louvre: 7,219
- latexr 11mo agoSpaces are skewing the numbers lower. Remove them from any of those and see the number increase at least an order of magnitude. That “let me login” goes from 0 to 4,714 just by removing spaces (“letmelogin”).
- AlienRobot 11mo agoI guess this means passwords with spaces are safer!
- neogodless 11mo agocorrecthorsebatterystaple (no spaces) 4,163
- bdcravens 11mo agoI was trying random phrases just out of curiosity, and couldn't help but chuckle when it said "epsteinfiles" wasn't found :-)
- the8472 11mo agoThis doesn't help. If the email address check says the address has been exposed it doesn't tell you which password that was used together with that has been exposed. Was it one from 10 years ago you don't even remember? Or that's still actively in use? Which one of my hundreds of passwords?
- Thorrez 11mo agoYou can use the API to check all of your passwords. Then you'll know the security state of all of your passwords. https://haveibeenpwned.com/API/v3 https://haveibeenpwned.com/API/v3
- the8472 11mo agoDoesn't help. Some accounts are old and may not be in my current PW DB. Or they were memorized, or forgotten. If the thing suggests the EMAIL (+ associated password) has been compromised for some unknown account then to do a risk assessment I would have find which account it belongs to, not which currently-in-use passwords match the same datasets. Those are different queries, providing different bits of information.
- Thorrez 11mo agoHere's what I'm suggesting: query all your current passwords against the password API. Then you'll know which of your current password are compromised. Change them. You don't need to query old passwords, only current passwords. If you're talking about accounts that you've forgotten the password to: then do you care about those accounts? If yes, probably best to do a password reset and set a new password. If you don't care about the account, then why bother? As for why HIBP doesn't provide an API linking passwords to emails: HIBP has no database that links passwords and emails. So they can't provide any way to query that. They don't want to be in the business of linking passwords to emails.
- ekjhgkejhgk 11mo agoOf course it helps. How's this for making it actionable: Regardless of whether or not someone can associate it with your email, if your password has been seen in the wild, change it. There you go.