Re:"Pwned Passwords" V2 With Half a Billion Passwords
by jobigoud on Wednesday February 21, 2018 @05:18PM
(#16433488)
It's indeed weird that "00000" would be the hash prefix with the highest number of entries. I think it must be a hidden variable. Like some sources put an all-zeroed-out hash in the database for testing or in case of a registration error or for deleted users, and these show up here.
[ Parent
| on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords
by cmurphycode on Wednesday February 21, 2018 @07:52PM
(#16434312)
Great thought, but it doesn't seem to be the case - as the number of unique suffixes is the large number here -- in fact, none of the values in the range are simply all zeroes.
https://api.pwnedpasswords.com/range/00000
I wonder if the hidden variable is something to do with how the passwords are leaked. First, let's suppose that a very commonly used broken password hash is plain SHA-1 (I think that's a valid assumption-- unfortunately!). Then, let's figure that amongst the many data dumps / extracts done by hackers, some of them are only able to extract part of the database, or save part of the database, or whatever....and they are fetched / saved / uploaded in lexical order?
Can't think of anything else.
EDIT: Ooops. The other thing is, that these actually are sha-1 hashes of real plaintext passwords. So it's definitely not a test-row in that sense.