I implemented @troyhunt's HIBP password list as a pure Python3 Bloom filter, in 629MB (false positive rate = 0.0005)https://gist.github.com/marcan/23e1ec416bf884dcd7f0e635ce5f2724 …
-
using client side you now have to make a sha1 hash as well for the
@troyhunt check. Is that safe? Shouldn't it have been a stronger alg.?
These are leaked passwords. The hash is to lightly obfuscate them. By definition you can't use a salted hash because it's a lookup table.
-
-
There is no merit to client side hashing for login credentials usage, and "see if your password has leaked" sites aren't a good idea anyway.
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.