grep `read -sp "password: "; echo "$REPLY" | tr -d "\n" | shasum | cut -c6-40` hacked.txtI thought 16k entries might be reasonable but that doesn't even last 3 weeks for me. I think there might have been some issue with slow disk seeks so at some point I restricted it to that many.
I guess it probably it would be better to regularly backup the history file to deal with possible some accidental truncations and issues when running multiple shells concurrently, but probably the overall effort to set up such a system would outweight the benefits.
kill -9 $$Kill -9 -1 as root is a surefire way to make a system stop doing anything, fast.
$ echo linkedin | xargs node -e "var x = require('crypto').createHash('sha1').update(process.argv[1]).digest('hex'); console.log([x, '00000' + x.substring(5)]);"
7728240c80b6bfd450849405e8500d6d207783b6
0000040c80b6bfd450849405e8500d6d207783b6DDG supports SSL: https://www.duckduckgo.com/
If you want coverage, generate a few hundred thousand SHA1 hashes along with your password.
Actually, running a trickle query of random SHA1 hashes from your box might be a fun exercise, along with a trickle query of random word tuples (bonus points for using Markov chains to generate statistically probable tuples).
At worst you're giving the attacker a hash target to try brunting. He still has to brute it, and that takes time. Select your plaintext from a large enough keyspace and it's astronomical time.
I'll need to review their policy more closely, but DDG claim fairly minimal tracking. At best someone might be able to correlate hash lookup with some IP space. That's a long way from handing over passwords. And as I already indicated, you could cradled the queries to make the search space much larger.
When you search for 'sha1 foo', that query ("sha1 foo") goes up to the server. They know your password is "foo" and that you're attempting to "sha1" it. They don't have a hash, they take that data and perform the hash, then send that down to you.
OK, gotchya.
I guess I'm just too damned used to using systems that, you know, have useful tools installed locally (or can get them there really damned fast). Including SHA1 and MD5 hash generators.
And I was all worked up to tell you how wrong you were still being.
All because I couldn't fathom the possibility let alone reason anyone would need a third-party site to compute their hashes for them.
Silly me, my error.
curl -s -d q="sha1 password" http://duckduckgo.com | w3m -T text/html | grep '\w\+\{32\}'
" xargs node -e "
do?
Thank you
$ node -e "console.log('Hello, world.')"
Hello, world.
$ echo /usr/share/dict/words | xargs head -5
A
A's
AOL
AOL's
$ echo petard | xargs -I {} grep {} /usr/share/dict/words
petard
petard's
petards
$ echo is dog this yes | xargs node -e "console.log(process.argv.slice(1).sort().reverse().join(' ').toUpperCase())"
YES THIS IS DOGsame result as with xargs
grep petard /usr/share/dict/words
same result as with xargs
not sure what you are trying to demonstrate here
useless use of xargs?
Are you even reading this discussion properly or are you just searching for some shell snippets and ridicule them as soon as you get a chance? This is what it looks like from your history: http://news.ycombinator.com/threads?id=uselessuseof
ionwake doesn't want to learn how to search a word. He wants to know how 'xargs node -e' works. Please read this again: http://news.ycombinator.com/item?id=4075293
$ echo linkedin | xargs node -e "var x = require('crypto').createHash('sha1').update(process.argv[1]).digest('hex'); console.log(x.substring(5));" | xargs -I {} grep {} hashes.txt
Personally, while I don't, I do tend to get a little aggressive and then I'm often surprised with the backlash, because I get that way when I'm genuinely enjoying the conversation, not when I'm irritated.
The hypocrisy is so unabashed my brain might explode.
- not portable
- useless use of backticks
printf password|openssl sha1|cut -c6-40|grep -f - hacked.txt