Date: Sun, 29 Jul 2018 06:53:06 +0000 (UTC) From: Stefan Esser <se@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r475628 - head/security/pwned-check/files Message-ID: <201807290653.w6T6r6xJ054525@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: se Date: Sun Jul 29 06:53:06 2018 New Revision: 475628 URL: https://svnweb.freebsd.org/changeset/ports/475628 Log: Add support for the remote query API. This obviates the need to download the > 10 GB pawned password hash list, which requires nearly 20 GB after decompression. The API does not transfer the queried password or its full SHA1 hash to the server, but only the first 5 characters of the hash. This allows to retrieve the full password hashes that match that prefix (typically in the order of 500) and then to check whether the password to test matches any of the hashes returned. Approved by: antoine (implicit) Modified: head/security/pwned-check/files/pwned-check.1.in head/security/pwned-check/files/pwned-check.sh.in Modified: head/security/pwned-check/files/pwned-check.1.in ============================================================================== --- head/security/pwned-check/files/pwned-check.1.in Sun Jul 29 04:31:44 2018 (r475627) +++ head/security/pwned-check/files/pwned-check.1.in Sun Jul 29 06:53:06 2018 (r475628) @@ -10,7 +10,7 @@ .Sh DESCRIPTION The .Nm -utility checks the passwords piped in via standard input (one per line) +utility checks the passwords piped in via standard input (one per line) against a huge database of passwords that are known to have been stolen in data breaches. .Pp @@ -22,6 +22,15 @@ on standard output and the exit status of .Nm is set to 1. No output is generated for passwords not found in the database. +.Pp +The database can be downloaded to a local directory or it can be queried +by a method that does not make the hash queried known to the remote +server. +The remote query is performed if the pawned password database has not +been fetched and stored on the local system. +While the remote accesses are not as fast as a local lookup, they will +query an always up-to-date database and allow to avoid the download and +storage of this huge database. .Pp Instead of plain passwords, SHA1 hashes of passwords may be supplied. Matches will be reported, but there is no provision to report the Modified: head/security/pwned-check/files/pwned-check.sh.in ============================================================================== --- head/security/pwned-check/files/pwned-check.sh.in Sun Jul 29 04:31:44 2018 (r475627) +++ head/security/pwned-check/files/pwned-check.sh.in Sun Jul 29 06:53:06 2018 (r475628) @@ -82,14 +82,20 @@ exitcode=0 lookup () { - local hash="$1" - look "$hash" pwned-passwords*.txt > /dev/null + local hash=$(echo "$1" | tr 'a-z' 'A-Z') + if [ "$USEFILES" = yes ]; then + look "$hash" pwned-passwords*.txt > /dev/null + else + expected=${hash#?????} + prefix=${hash%$expected} + fetch -q -o - https://api.pwnedpasswords.com/range/$prefix 2>/dev/null | grep -i "^$expected:" >/dev/null + fi } checkpw () { local pwd="$1" - local hash=$(echo -n "$pwd" | sha1 | tr 'a-z' 'A-Z') + local hash=$(echo -n "$pwd" | sha1) if lookup "$hash"; then echo "$pwd" exitcode=1 @@ -102,8 +108,10 @@ checkpw () } # Main program -cd "$DBDIR" || errexit "Database directory '$DBDIR' not found." export LC_COLLATE=C +if cd "$DBDIR" && ls pwned-passwords*.txt; then + USEFILES=yes +fi >/dev/null 2>&1 if [ "$#" -gt 0 ]; then if [ "$1" = "-u" ]; then
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201807290653.w6T6r6xJ054525>