Show HN: Passpwn – check passwords in pass against haveibeenpwned

Re:Show HN: Passpwn – check passwords in pass against haveib... by jstanley on Saturday February 24, 2018 @08:45PM (#16456648)

Regardless of your threat model, you can read the code and see how it works. It's short and easy to understand. It doesn't send anything more than the first 5 characters of the SHA1 hash.

[ Parent | on HN ]

Re:Show HN: Passpwn – check passwords in pass against haveib... by ChrisSD on Sunday February 25, 2018 @05:13AM (#16458199)

Sure but that leaks some information about your password. SHA-1 hashes are significantly quicker to compute than a password hash (and rainbow tables exist making it even faster). So the first five characters can be used to narrow the search space.

This is however not likely a real problem unless your threat model includes targeted attacks.

[ Parent | on HN ]