News for hackers. Stuff that matters.

A comment on Show HN: Passpwn – check passwords in pass against haveibeenpwned. Parent comment

Re:Show HN: Passpwn – check passwords in pass against haveib... by p49k on Saturday February 24, 2018 @11:37AM (#16453974)
It sends the first 5 characters of the SHA-1 hash to the API, which seems reasonable. To be safe, you could check after rotating all your passwords, or I suppose you could download the raw data yourself to check directly.

And the API is controlled by Troy Hunt, not some rando.

[ Parent | on HN ]
Re:Show HN: Passpwn – check passwords in pass against haveib... by ChrisSD on Saturday February 24, 2018 @01:34PM (#16454564)
Troy Hunt and people who work at Cloudflare. But yeah it depends on your threat model. If it's just a random website password than it's probably fine to check. If you're trying to keep secrets from the state then maybe not.
[ Parent | on HN ]
Re:Show HN: Passpwn – check passwords in pass against haveib... by jstanley on Saturday February 24, 2018 @08:45PM (#16456648)
Regardless of your threat model, you can read the code and see how it works. It's short and easy to understand. It doesn't send anything more than the first 5 characters of the SHA1 hash.
[ Parent | on HN ]
Re:Show HN: Passpwn – check passwords in pass against haveib... by ChrisSD on Sunday February 25, 2018 @05:13AM (#16458199)
Sure but that leaks some information about your password. SHA-1 hashes are significantly quicker to compute than a password hash (and rainbow tables exist making it even faster). So the first five characters can be used to narrow the search space.

This is however not likely a real problem unless your threat model includes targeted attacks.

[ Parent | on HN ]