4 ms·

It seems very useful for research and also practical uses, like how about a REST API with this dump? get <password> will not only return true if it exists but h

It seems very useful for research and also practical uses, like how about a REST API with this dump? get <password> will not only return true if it exists but how common and how weak it is, or will return a false for unique. Is there such a service out there?

lumpypua 12y ago
Go make it! :)
- bikamonki 12y ago
  Hahaha sure if I did not had enough side projects of the side projects of the side projects ;)
- joshmn 12y ago
  I'm on it.
akerl_ 12y ago
This seems a bit like testing if your parachute was packed properly by deploying it. Once I've sent my password at a 3rd party API, it doesn't much matter what the API says: my password is no longer secure.
- bikamonki 12y ago
  Correct, but every site where you signup does that and I do not think anyone cares. Maybe such API will not be for end users but for other apps to run signup forms against it and help users choose a better one. In any case, the whole password deal is broken. I now use my own offline pwd generator for the "important" sites but I guess I am not the average Internet user.
  - akerl_ 12y ago
    What site out there is sending my plaintext passwords to a 3rd party service to validate their strength?
    - bikamonki 12y ago
      Hopefully none, and hopefully they are all following best practices to protect your password, but you trust them regardless. Besides, who said plain text, such service could use ssl.
      - agersant 12y ago
        I think he meant plaintext as opposed to a hash of the password.
pbreit 12y ago
How is that even slightly useful?
benbristow 12y ago
Nice idea. Working on a simple Rails API now that will return a JSON response. Will take a while to import all the passwords though. Currently got it returning this JSON: {"found":true,"password":"test","count":117}
farresito 12y ago
With all due respect, I think this is a horrible idea. Isn't it just better to simply download the dump and filter the information with the command line? Why would someone even want to write a program that connects to an API to get info like this? You don't really need to know too much to be able to filter values like those, and it's way more flexible.

lumpypua 12y ago

Go make it! :)

bikamonki 12y ago
Hahaha sure if I did not had enough side projects of the side projects of the side projects ;)
joshmn 12y ago
I'm on it.

akerl_ 12y ago

This seems a bit like testing if your parachute was packed properly by deploying it. Once I've sent my password at a 3rd party API, it doesn't much matter what the API says: my password is no longer secure.

bikamonki 12y ago
Correct, but every site where you signup does that and I do not think anyone cares. Maybe such API will not be for end users but for other apps to run signup forms against it and help users choose a better one. In any case, the whole password deal is broken. I now use my own offline pwd generator for the "important" sites but I guess I am not the average Internet user.
- akerl_ 12y ago
  What site out there is sending my plaintext passwords to a 3rd party service to validate their strength?
  - bikamonki 12y ago
    Hopefully none, and hopefully they are all following best practices to protect your password, but you trust them regardless. Besides, who said plain text, such service could use ssl.
    - agersant 12y ago
      I think he meant plaintext as opposed to a hash of the password.

pbreit 12y ago

How is that even slightly useful?

benbristow 12y ago

Nice idea. Working on a simple Rails API now that will return a JSON response. Will take a while to import all the passwords though. Currently got it returning this JSON: {"found":true,"password":"test","count":117}

farresito 12y ago

With all due respect, I think this is a horrible idea. Isn't it just better to simply download the dump and filter the information with the command line? Why would someone even want to write a program that connects to an API to get info like this? You don't really need to know too much to be able to filter values like those, and it's way more flexible.