61–70 of 194 posts
I made something almost the same (including name!), except all check is done in browser: http://crackedin.s3-website-us-east-1.amazonaws.com/ And it's hosted on S3 so it is faster :)
Interesting implementation, but won't this eat up a lot of bandwidth and cause a high S3 bill?
Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
If you don't particularly trust the included click.js script, you can generate your password's SHA-1 via python fairly easily python -c 'import hashlib; print hashlib.sha1("PaSSw0rd").hexdigest()'
printf PaSSw0rd | sha1sumNow there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.
(BTW, be sure to type some gibberish into the provided box and hit submit, so you can see why I think this is a very relevant link.)
Earlier quoted context omitted.
I think it'd be best to provide people with a simple way to generate their hash with a well-known tool they already trust - eg, an openssl command.
For the record, on a Mac, save your password in a text file called password, without a return at the end of the line. Then: openssl dgst -sha1 password will give you the hash you need. Mine has been leaked but not cracked, according to this site :-(.
echo -n "password" | openssl dgst -sha1how can they tell what was leaked but not cracked?
Oh.. Didn't know anyone already made this - i also made a tool, but it doesn't send your whole hash over the wire (only the last 4 chars). http://olemartin.org/linkedin-passwords/
Mine was not in the list. I had a non-dictionary password with letters and numbers, 8 characters, and it was at least several months old. (If we can collect enough data points of whose passwords are on it or not, how old they are, and how complex the password was, we should be able to narrow down a potential date range for the list and the odds that the compromised list is full or partial.)
Oh.. Didn't know anyone already made this - i also made a tool, but it doesn't send your whole hash over the wire (only the last 4 chars). http://olemartin.org/linkedin-passwords/
for example this tool says the word "test" hashes with the last 5 digits of 77136 where as leaked in translates the word "test" to fbbd3. hmmm