nowfound

Life & fun · April 24, 2019

PA

PwnedPasswords as a (Micro)Service

Recently I became interested in knowing whether the passwords I used were in the list of breached passwords. One way to find out is to send your password to the link here https://haveibeenpwned.com/Passwords. However, while the owner of that website is a well respected security researcher, I still don't think it's wise to send my password to another website. So I downloaded the 24gb file, hashed my password and grepped the file for it. That unfortunately took a long time and I realized this was the perfect opportunity to use a BloomFilter and test the inclusion of a password…

Alternatives

What it does

In the maker’s words, at launch

Recently I became interested in knowing whether the passwords I used were in the list of breached passwords. One way to find out is to send your password to the link here https://haveibeenpwned.com/Passwords. However, while the owner of that website is a well respected security researcher, I still don't think it's wise to send my password to another website. So I downloaded the 24gb file, hashed my password and grepped the file for it. That unfortunately took a long time and I realized this was the perfect opportunity to use a BloomFilter and test the inclusion of a password in a set. With a bloomfilter, the 24gb file can be compressed down to ~2gb assuming a false positive rate of 1 in a million. You can achieve even better rates with lower false positives. Despite it dropping to 2gb, I wasn't satisfied and decided to compress the bloomfilter using golomb codes. This type of data structure is known as a golomb set and I was able to get the database down to ~1.475gb. That makes it small enough to exist in a microservice that any company can use to test whether users are using hacked passwords. With a golomb set the time to test a password was microseconds. I made some node js bindings and put the file in a simple express app. Now anyone can create a pwned password as a micro-service! It's open source because you can audit the code and confirm no one is logging your passwords. Anyway thought I'd share it since I'm more or less done with this. Future work could split the 2gb file into on disk files and therefore require significantly less ram to work. This would be a great use case of storing the entire list in a laptop or phone for example, where it would take 1.5gb of disk, but be able to quickly tell you if a password you are typing is in a breached list. Anyways here's the link: https://github.com/terencechow/PwnedPasswords Cheers!

Does the same job

all alternatives →
  • ';--have i been pwned?2014 · ▲273

    Check if your account has been compromised in a data breach

  • IP
    Instantly pass your passwords securely2019 · ▲31

    Hey HN! I made a service to share passwords easy and secure but never promoted it. It's called instapass.io I noticed that people besides my friends and clients actually started to use, so maybe it will be helpful for you too! You share one-time self-destruct message using one time links and I won't even be able to see what you wrote. How does it work? When you generate a message the client-side makes a random password and use that to encrypt the message. The password is appended as an anchor tag which all modern browsers never send to the server. This way, I don't even know what you shared.…

  • Easy Peasy Password2019 · ▲211

    Generate a strong and funny password that you can remember

  • Passwarden2020 · ▲95

    Secure storage for your passwords & personal information

  • HelpSpot Vault2016 · ▲105

    Passwords sent over email live forever, but not with Vault.

  • Getpass2018 · ▲173

    A simple and clean password generator 🔐

More life & fun this month

the category →
  • TL
    The load-bearing vocabulary of Claude▲703

    Life & fun · 10d ago · louisabraham.github.io

  • iPhone app takes simultaneous images from 2 lenses, fuses into 1 photo▲329

    Photosynthesis fires two of your iPhone

    Life & fun · 28d ago · photosynthesis.camera

  • SoloUno▲310

    Take control of hair pulling, nail biting & skin picking

    Life & fun · 28d ago · solouno.io

  • Scroll through all 43252003274489856000 Rubik's Cube states▲295

    Scroll through all 43,252,003,274,489,856,000 reachable Rubik's Cube permutations.

    Life & fun · 26d ago · everycube.alen.is

  • Expeditione▲265

    The Interactive 3D Encyclopedia

    Life & fun · 21d ago · expeditione.fun

  • Eigendrum - Draw any shape and hear what it sounds like as a drum▲243

    Hi HN, I built Eigendrum, a web tool that solves the 2D wave equation for arbitrary shapes so you can hear what they sound like as drums. How it works: * Solves -∇²u = λu using finite element analysis (Kφ = λMφ) on a triangle mesh. * Validated to <0.1% error against closed-form solutions for circles (Bessel zeros) and rectangles. * Sound model factors in strike location, Rayleigh damping, and mallet width. * Includes Kac drums I & II to demonstrate identical sound spectra from different geometries. * No frameworks, build steps, or dependencies. Repo and tests:…

    Life & fun · 26d ago · baselashraf81.github.io

Launched alongside, April 2019

the whole month →