Is it safe to test my password on this website? (because I just did)
300M Freely Downloadable Pwned Passwords
11–20 of 184 posts
Re: 300M Freely Downloadable Pwned Passwords
#12Interesting - "correct horse battery staple"[0] is flagged as not being in the data set. I was sure someone should have used that by now.
Re: 300M Freely Downloadable Pwned Passwords
#13I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?
Well for that you can probably turn off JavaScript or use the web inspector to enable paste.
I can. My wife, who I've taught to use a password manager, probably can't. And neither of these excuses a 27 character limit that strongly suggests my password is being stored unencrypted somewhere.
Re: 300M Freely Downloadable Pwned Passwords
#14Re: 300M Freely Downloadable Pwned Passwords
#15Going to generate a bloom-filter from this dataset tonight. Troy mentions some arguments against torrents, but it is better to have a authoritative torrent than none, imo.
Is a bloom filter worth it in this case? With the optimal "k" hash functions of 10 and a "p" error rate of 0.001% (false positives of approximately 1 in 1000), a bloom filter for the 306,259,512 items will take 538 MB. Increasing the error rate to 0.01% (1 in 100) is still 358 MB. That's a sizeable filter to maintain in memory (then again... RAM is cheap). I'd probably just shove the passwords into a database, limiti…
Distributing a 538 MB file (which can be compressed further) is much easier.
Re: 300M Freely Downloadable Pwned Passwords
#16Interesting - "correct horse battery staple"[0] is flagged as not being in the data set. I was sure someone should have used that by now. [0] https://xkcd.com/936/
It shows up if you remove the spaces.
Re: 300M Freely Downloadable Pwned Passwords
#17Earlier quoted context omitted.
If you only have one password to try, I'd say you have more important issues to tackle. Install a password manager, start using generated passwords, and stop using 'your password'.
Well, in that case, “your password” might be the only one you have – the one use for your password manager.
salt "your password" with https://www.passwordcard.org/en
Re: 300M Freely Downloadable Pwned Passwords
#18Earlier quoted context omitted.
http://inutile.club/estatis/password-security-checker/
Hehe, I was just about to build something similar. I like the extra touch of it not even being served over https.
Also the option to test another password is nice, and the unsatisfied curiosity you're left with if you go down that route.
Re: 300M Freely Downloadable Pwned Passwords
#19What would be the best data structure for using this in, say, a Python script? I imagine just putting it into a dictionary (hash map etc.) won't work because of the size.
Re: 300M Freely Downloadable Pwned Passwords
#20What would be the best data structure for using this in, say, a Python script? I imagine just putting it into a dictionary (hash map etc.) won't work because of the size.
Bloom filter :-)