Firefox to Warn When Saved Logins Are Found in Data Breaches

Re:Firefox to Warn When Saved Logins Are Found in Data Breaches by nighthawk454 on Wednesday July 17, 2019 @05:12PM (#20464079)

Keep in mind that your password may not be contained in the result set from HIBP (and if it is, you should likely change it anyway). So the attack space is only reduced to "any string whose hash begins with these characters", which should be considerably larger than 500 or however many results HIBP returns. It would be drastically smaller only if the attacker knew the hash was contained in HIBP.

Effectively, since HIBP asks for 5 characters of the hash, the space is the same as if the full hash were 5 characters shorter.

[ Parent | on HN ]

Re:Firefox to Warn When Saved Logins Are Found in Data Breaches by prepend on Wednesday July 17, 2019 @07:01PM (#20464913)

This is a good point as not all passwords will be in known set.

I guess it’s only a 1:500 if the password has been pwned. In which case, the owner should promptly change it and remove the risk.

Thanks, I didn’t think of that. For some reason I was stuck in thinking that all passwords have been pwned and in the file.

[ Parent | on HN ]