Re:Why Searching Through 500M Pwned Passwords Is So Quick
by jgrahamc on Tuesday February 27, 2018 @08:00AM
(#16472976)
That won't work since all possible 5 character prefixes return data.
Re:Why Searching Through 500M Pwned Passwords Is So Quick
by moviuro on Tuesday February 27, 2018 @08:55AM
(#16473329)
They don't all return the same amount though. According to my Chrome here and now:
> https://api.pwnedpasswords.com/range/aaaaa = 28.8KB
> https://api.pwnedpasswords.com/range/01234 = 28.5KB
> https://api.pwnedpasswords.com/range/af0fa = 23.2KB
You could still run a volume analysis on the reply. If it's very short, you can guess it's a 404. If it isn't, you might be able to get which prefix was queried... \end{tin foil hat}