I implemented @troyhunt's HIBP password list as a pure Python3 Bloom filter, in 629MB (false positive rate = 0.0005)https://gist.github.com/marcan/23e1ec416bf884dcd7f0e635ce5f2724 …
-
I would advice against using such a massive block list, top 1K-10K is enough, & implement other serverside features instead. Better UX.
Top 1K-10K is way too easy to brute force. I could implement attempt throttling, but that's a massive can of worms and hard to get right.
-
-
Too easy? Dude, If somebody has your hashes you're pwnd already! Nobody attacks online login using a 306 million wordlist.
-
But people *do* attack online login with a 10k wordlist.
- Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.