Comment

Comment on Guys Did I Get Scammed?

observantTrapezium@lemmy.ca ⁨2⁩ ⁨weeks⁩ ago

No issue if the info gets hashed and the service’s database is only searched for the hash à la have I been pwned, it’s probably legit 😜

Sort:hotnew top

justme@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago
according to their website:

Pwned Passwords uses a model called k-anonymity to let you check whether a password has been seen before without ever sending the full password or its complete hash to the service. Instead, your password is hashed locally and only the first 5 characters of the SHA-1 hash are sent to the API. The service returns a list of matching suffixes, and the full comparison happens on your side so the password itself remains private.

and you can either download the open source client from GitHub, or spin up your own with their API (i would imagine that you can almost do this in a bash one-liner, but haven’t looked into the details yet). that sounds good enough to me

source