News for hackers. Stuff that matters.

A comment on Why Searching Through 500M Pwned Passwords Is So Quick. Parent comment

Re:Why Searching Through 500M Pwned Passwords Is So Quick by Cthulhu_ on Tuesday February 27, 2018 @06:54AM (#16472675)
In this case though, security concerns do not apply; the source data is secure, the website does not use authentication, and HTTPS adds an extra layer of security on any input (which is hashed and cropped clientside)
[ Parent | on HN ]
Re:Why Searching Through 500M Pwned Passwords Is So Quick by moviuro on Tuesday February 27, 2018 @07:27AM (#16472815)
> on any input (which is hashed and cropped clientside)

You could still run a volume analysis on the reply. If it's very short, you can guess it's a 404. If it isn't, you might be able to get which prefix was queried... \end{tin foil hat}

[ Parent | on HN ]
Re:Why Searching Through 500M Pwned Passwords Is So Quick by jgrahamc on Tuesday February 27, 2018 @08:00AM (#16472976)
That won't work since all possible 5 character prefixes return data.
[ Parent | on HN ]
Re:Why Searching Through 500M Pwned Passwords Is So Quick by moviuro on Tuesday February 27, 2018 @08:55AM (#16473329)
They don't all return the same amount though. According to my Chrome here and now:

> https://api.pwnedpasswords.com/range/aaaaa = 28.8KB

> https://api.pwnedpasswords.com/range/01234 = 28.5KB

> https://api.pwnedpasswords.com/range/af0fa = 23.2KB

[ Parent | on HN ]
Re:Why Searching Through 500M Pwned Passwords Is So Quick by voltagex_ on Tuesday February 27, 2018 @10:39AM (#16474284)
Isn't Chrome seeing the decrypted and decompressed response in DevTools? I'd be more interested in what you see in Wireshark.
[ Parent | on HN ]
Re:Why Searching Through 500M Pwned Passwords Is So Quick by moviuro on Wednesday February 28, 2018 @03:53AM (#16481661)
Sadly not available on my current machine :(

The experiment is left as an exercise to the reader :)

[ Parent | on HN ]