I implemented @troyhunt's HIBP password list as a pure Python3 Bloom filter, in 629MB (false positive rate = 0.0005)https://gist.github.com/marcan/23e1ec416bf884dcd7f0e635ce5f2724 …
-
-
And this is how I will be using it in production, on the
@euskalencounter reservations website. Comments welcome :)pic.twitter.com/al2DpM2z5P
10 replies 25 retweets 80 likes -
Replying to @marcan42
I would advice against using such a massive block list, top 1K-10K is enough, & implement other serverside features instead. Better UX.
3 replies 1 retweet 6 likes -
Replying to @thorsheim @marcan42
That interest me. You mean it is not good idea to ban setting any of public leaked passwords?
1 reply 0 retweets 0 likes -
Replying to @tomashala @marcan42
This is worthy of a paper, Twitter not sufficient. I imagine blocking 306 million pwds would cause massive customer loss & complaints.
3 replies 2 retweets 4 likes -
Replying to @thorsheim @marcan42
Maybe not ban all of them but only display warning could be the way. What would
@troyhunt say? Seems to be worth to write the blogpost :)3 replies 0 retweets 0 likes -
There are certainly tradeoffs to be had and not all sites are created equal. For example, I expect our customers to be more accepting.
2 replies 0 retweets 0 likes
Our system is currently in production but only active for staff (which I *definitely* don't want using a weak password) right now.
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.