<story><title>The Naz.API Credential Stuffing List</title><url>https://www.troyhunt.com/inside-the-massive-naz-api-credential-stuffing-list/</url></story><parent_chain><item><author>lelanthran</author><text>The HIBP database really should be open to the world, with the email being redacted.&lt;p&gt;I would love to grep the list of 25m passwords to see if any of mine are in there.&lt;p&gt;I don&amp;#x27;t particularly want to send my details to HIBP to check if I have been compromised.</text></item></parent_chain><comment><author>andrewla</author><text>It&amp;#x27;s easy to check through their verification service if your passwords have been compromised.&lt;p&gt;Hash your password locally&lt;p&gt;&lt;pre&gt;&lt;code&gt;    $ echo -n fredflinstone | shasum
    95e47d937e105fa1cc84bfa476b10f091304c090  - 
&lt;/code&gt;&lt;/pre&gt;
Then take the first five characters of the hash and invoke the API&lt;p&gt;&lt;pre&gt;&lt;code&gt;    $ curl https:&amp;#x2F;&amp;#x2F;api.pwnedpasswords.com&amp;#x2F;range&amp;#x2F;95e47
    ...
    D8F3BA8D3952AA8917C78295EE1122F675C:17
    D910D224A8450006478ED28D2CE2D005343:10
    D91C102088F1D91469B803235DB60903259:874
    D937E105FA1CC84BFA476B10F091304C090:290
    D96BF2796784C142392D8B46AEF68B991D0:4
    D98009835A90E46EFFD43AC3E5C6BD1C14B:5
&lt;/code&gt;&lt;/pre&gt;
And there we have it -- my password is compromised (the suffix D937...)&lt;p&gt;Easy enough to script this up with minimal information leakage. All you&amp;#x27;re sending is 20 bits; that&amp;#x27;s not enough to do anything malicious even if your password is compromised.</text></comment>
<story><title>The Naz.API Credential Stuffing List</title><url>https://www.troyhunt.com/inside-the-massive-naz-api-credential-stuffing-list/</url></story><parent_chain><item><author>lelanthran</author><text>The HIBP database really should be open to the world, with the email being redacted.&lt;p&gt;I would love to grep the list of 25m passwords to see if any of mine are in there.&lt;p&gt;I don&amp;#x27;t particularly want to send my details to HIBP to check if I have been compromised.</text></item></parent_chain><comment><author>hennell</author><text>They have a downloader for the hashed password list:
&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;HaveIBeenPwned&amp;#x2F;PwnedPasswordsDownloader&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;HaveIBeenPwned&amp;#x2F;PwnedPasswordsDownloader&lt;/a&gt;</text></comment>