News for hackers. Stuff that matters.

A comment on "Pwned Passwords" V2 With Half a Billion Passwords.

Re:"Pwned Passwords" V2 With Half a Billion Passwords by orasis on Wednesday February 21, 2018 @04:24PM (#16433101)
Can someone please just provide the exact shell commands to generate a compatible sha-1 of a password to grep against the database?

The article seems to ramble forever about how to perform online checks without discussing the basic offline secure option.

[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by jffry on Wednesday February 21, 2018 @04:34PM (#16433180) 

  echo -n 'P@ssw0rd' | shasum -t 1 -
gives me the same value (21bd12dc183f740ee76f27b78eb39c8ad972a757) as appears in the article.
[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by ianlevesque on Wednesday February 21, 2018 @04:29PM (#16433145)
echo -n "password" | openssl sha1 | tr '[:lower:]' '[:upper:]'
[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by mnutt on Wednesday February 21, 2018 @04:50PM (#16433286)
You may also want to consider running `unset HISTFILE` before that to ensure that the line containing your password doesn't end up sitting around in your bash history.
[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by r1ch on Wednesday February 21, 2018 @05:39PM (#16433632)
Another way is to prefix the command with whitespace.
[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by baliex on Wednesday February 21, 2018 @05:57PM (#16433732)
Only if..

    export HISTCONTROL=ignorespace
..is set (either by default or explicitly)
[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by deathanatos on Wednesday February 21, 2018 @09:30PM (#16434742) 

  python3 -c 'import getpass, hashlib; print(hashlib.sha1(getpass.getpass().encode("utf-8")).hexdigest())'
Avoids history, doesn't echo to the terminal.

In fact, you should be able to just make a rudimentary CLI into Troy's API simply with:

  #!/bin/bash
  HASH="$(python3 -c 'import getpass, hashlib; print(hashlib.sha1(getpass.getpass().encode("utf-8")).hexdigest().upper())')"
  curl -sS "https://api.pwnedpasswords.com/range/${HASH:0:5}" | grep "${HASH:5}"
(It'll emit the line from the API response matching your pass; if it does, then that password was compromised. Bash isn't real good at error handling though, so my biggest concern would be what this might do if an HTTP/TCP error happened. I've attempted to throw -S there to catch that, but use with your head screwed on.)
[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by pieguy on Wednesday February 21, 2018 @05:04PM (#16433403)
On my machine this produces

  (STDIN)= 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8
Which is obviously not what you want. So I changed it to:

  echo -n "$password" | openssl sha1 -binary | xxd -p -u
[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by squegles on Wednesday February 21, 2018 @05:32PM (#16433586)
This worked. Wow an old, old password that is fairly unique was seen 36 times.
[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by georgyo on Wednesday February 21, 2018 @04:33PM (#16433172)
echo -n "password"

echo adds a new line that is likely not in your password.

[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by noja on Wednesday February 21, 2018 @04:59PM (#16433374)
No it doesn't:

       -n     do not output the trailing newline
[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by zyxzkz on Wednesday February 21, 2018 @05:18PM (#16433486)
He's saying echo without an argument emits a newline, so use -n to suppress it.
[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by noja on Thursday February 22, 2018 @01:08PM (#16439751)
Oops. Thanks.
[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by adrianmonk on Wednesday February 21, 2018 @05:59PM (#16433742)
You could skip the "tr" part, as the API to query by hash prefixes not case sensitive, and once you have its results, you can use "grep -i" with the hash.
[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by Felk on Wednesday February 21, 2018 @04:34PM (#16433176)
echo -n "password" | sha1sum

then to remove the sha1sum's trailing spaces and dash: | sed 's/\s.*$//'

and then to uppercase it, as ianlevesque showed: | tr '[:lower:]' '[:upper:]'

[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by benbristow on Wednesday February 21, 2018 @04:28PM (#16433136)
http://onlinemd5.com/

Just uses JavaScript in the browser

[ Parent | on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords by mnutt on Wednesday February 21, 2018 @04:32PM (#16433170)
I wouldn't recommend using this. Even if you were to read the page source and see that it is in fact not sending data back to a third party, either a) the site owner could change this in the future, or b) you could be man-in-the-middle'd since they're using http, or c) one of the third party scripts they run on that page could either accidentally or intentionally take your password. Don't put your password in there.
[ Parent | on HN ]