News for hackers. Stuff that matters.

A comment on Blooming Password – A banned password check using a bloom filter. Parent comment

Re:Blooming Password – A banned password check using a bloom... by lightbyte on Friday June 15, 2018 @03:15PM (#17322677)
Collisions for the entire hash are rare, but this is just a prefix of the hash. I imagine it is significantly more common for a collision in the prefix.
[ Parent | on HN ]
Re:Blooming Password – A banned password check using a bloom... by ubernostrum on Friday June 15, 2018 @06:10PM (#17324054)
I maintain a library that talks to the Have I Been Pwned password database, which uses a 5-hexadecimal-digit prefix of the SHA1 hash.

Someone filed a PR asking to add a cache for HIBP's responses, and I did some quick math and came up with ~1200 as a birthday-paradox number for the first five digits of a SHA1 hex digest (assuming uniform/random distribution of hex digits).

[ Parent | on HN ]
Re:Blooming Password – A banned password check using a bloom... by tylersmith on Friday June 15, 2018 @04:47PM (#17323418)
If the bloom filter returns positive you check the HIBO DB by getting all the hashes with that prefix and check the returned list for the full hash.
[ Parent | on HN ]
Re:Blooming Password – A banned password check using a bloom... by basch on Friday June 15, 2018 @04:45PM (#17323407)
The average number of hashes returned is 478

The smallest is 381 (hash prefixes "E0812" and "E613D")

The largest is 584 (hash prefixes "00000" and "4A4E8")

https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...

[ Parent | on HN ]