Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's easy to check through their verification service if your passwords have been compromised.

Hash your password locally

    $ echo -n fredflinstone | shasum
    95e47d937e105fa1cc84bfa476b10f091304c090  -
Then take the first five characters of the hash and invoke the API

    $ curl https://api.pwnedpasswords.com/range/95e47
    ...
    D8F3BA8D3952AA8917C78295EE1122F675C:17
    D910D224A8450006478ED28D2CE2D005343:10
    D91C102088F1D91469B803235DB60903259:874
    D937E105FA1CC84BFA476B10F091304C090:290
    D96BF2796784C142392D8B46AEF68B991D0:4
    D98009835A90E46EFFD43AC3E5C6BD1C14B:5
And there we have it -- my password is compromised (the suffix D937...)

Easy enough to script this up with minimal information leakage. All you're sending is 20 bits; that's not enough to do anything malicious even if your password is compromised.



add two spaces right before the echo to avoid logging your secrets in the shell history


Or better, just do a `(read -s asdf; echo -n $asdf | shasum)` to create a temporary subshell and never even expose your password in the shell output.


will create interesting errors with certain characters


One space is sufficient in bash, if memory serves right.

And secondly, on macOS with the default config for zsh no amount of spaces will help, I think. You have to first configure zsh to ignore from history when starting with space. And after that I think one space will be enough.


That functionality in bash is controlled by the HISTCONTROL environment variable. Many systems this defaults to "ignorespace" but this isn't always the case.

On Fedora, with bash, HISTCONTROL defaults to "ignoredups" and is set by /etc/profile (unless it's changed in the last few years).

Usually you can set/unset the shell option "history". For instance, "set +o history" to disable history in the current shell and "set -o history" to turn it back on.

Edit, Looks like on Ubuntu HISTCONTROL=ignoreboth comes from .bashrc in /etc/skel/


thanks for the context


  % head -1 | tr -d \\n | shasum
Type your username and press the RETURN key.


This could be baked into BitWarden to be honest. Or is it already? Yeah it seems it's there already https://github.com/bitwarden/clients/issues/523


Prefix not suffix




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: