Pwned Passwords, Version 6

Re:Pwned Passwords, Version 6 by netman21 on Friday June 19, 2020 @10:24AM (#23574815)

I don't get what Troy Hunt has done to his tool. You used to be able to type in an email address and learn all the times your credentials have been in a leak/breach. Now he wants you to enter your password. What security minded person would reveal their password to a site like this? It would be trivial to associate your password to your IP address.

[ Parent | on HN ]

Re:Pwned Passwords, Version 6 by laken on Friday June 19, 2020 @10:29AM (#23574869)

You're getting two different tools mixed up -- "Have I Been Pwned?" and "Pwned Passwords."

Have I Been Pwned is the tool where you search your email, and it displays breaches.

Pwned Passwords is an API (there is a front-end but that's not the usecase) where you send a partial hash of a password to the API, and it returns a list of partial hashes that match, and the implementation from there sees if any of them match the full hash. It's used by quite a few online services to ensure users don't use weak passwords, as if it's shown up in multiple data breaches, they might not let you set it as your password.

[ Parent | on HN ]

Re:Pwned Passwords, Version 6 by fuhrysteve on Friday June 19, 2020 @10:56AM (#23575125)

Good article explaining how they use k-anonymity here:

https://blog.cloudflare.com/validating-leaked-passwords-with...

[ Parent | on HN ]

Re:Pwned Passwords, Version 6 by netman21 on Tuesday June 23, 2020 @02:12PM (#23617914)

Thanks! Now I get it.

[ Parent | on HN ]

Re:Pwned Passwords, Version 6 by Yanu-3452 on Friday June 19, 2020 @10:28AM (#23574853)

You're confusing pwned passwords wtih https://haveibeenpwned.com/

As for pwned passwords, it doesn't send the password. The way it works is that you submit the first 5 characters of a hash, and get back a list of all hashes.

You then locally compare the complete hash to see if it is there.

[ Parent | on HN ]

Re:Pwned Passwords, Version 6 by fenwick67 on Friday June 19, 2020 @10:26AM (#23574838)

This is a separate tool, HIBP is still up and running.

[ Parent | on HN ]

Re:Pwned Passwords, Version 6 by navanchauhan on Friday June 19, 2020 @10:28AM (#23574851)

umm, that feature is still there. This is for checking if the password you are using has been in any breach or not.

Also, the password doesn't go to the server but its hash goes.

Lastsly, he had to make the free API paid because people were DDOSing it

[ Parent | on HN ]

Re:Pwned Passwords, Version 6 by herodotus on Friday June 19, 2020 @10:28AM (#23574845)

I don't see this. I go to https://haveibeenpwned.com and it works just as before (email address only). I am slightly bothered that I can enter anyone's email address and learn something about them tho.

[ Parent | on HN ]

Re:Pwned Passwords, Version 6 by Flimm on Friday June 19, 2020 @11:26AM (#23575412)

Some breaches are marked as "sensitive". HIBP won't tell you if an email is in one of the sensitive breaches unless you prove ownership of the email address by clicking on a verification link.

[ Parent | on HN ]

Re:Pwned Passwords, Version 6 by c22 on Friday June 19, 2020 @10:31AM (#23574884)

You can learn even more about them by looking up their address in one of these (widely available) data dumps.

[ Parent | on HN ]

Re:Pwned Passwords, Version 6 by giantDinosaur on Friday June 19, 2020 @10:28AM (#23574848)

Is this not the tool (in some form) that's integrated with 1password? That one is indeed designed to check password hashes for matches in leaks.

[ Parent | on HN ]