Re:"Pwned Passwords" V2 With Half a Billion Passwords
by febed on Wednesday February 21, 2018 @07:29PM
(#16434221)
But Troy could still very easily guess the complete hash. It's the one with the 47,205 hits.
[ Parent
| on HN ]
Re:"Pwned Passwords" V2 With Half a Billion Passwords
by kbenson on Wednesday February 21, 2018 @11:11PM
(#16435092)
But's it's not always that hash. The password you're checking may not be on the list. This is just a quick check to see if the password in question is on the list, in which case it may be a poor choice depending on how often it's seen.
For example, say I want to check "gSAey27tgGsaEG". That hashes to c2e5dfb023cd42df94751581cba33b24bc011027. https://api.pwnedpasswords.com/range/c2e5d has no entry for fb023cd42df94751581cba33b24bc011027, so it's not even in the list of passwords.
Put another way, it averages a few hundred hashes per prefix based on the total password list size (~500M), but there's 2^136 possible has suffixes per prefix. There's no point in guessing that.