svn commit: r475628 - head/security/pwned-check/files
Stefan Esser
se at FreeBSD.org
Sun Jul 29 06:53:07 UTC 2018
Author: se
Date: Sun Jul 29 06:53:06 2018
New Revision: 475628
URL: https://svnweb.freebsd.org/changeset/ports/475628
Log:
Add support for the remote query API. This obviates the need to download
the > 10 GB pawned password hash list, which requires nearly 20 GB after
decompression.
The API does not transfer the queried password or its full SHA1 hash to
the server, but only the first 5 characters of the hash. This allows to
retrieve the full password hashes that match that prefix (typically in the
order of 500) and then to check whether the password to test matches any
of the hashes returned.
Approved by: antoine (implicit)
Modified:
head/security/pwned-check/files/pwned-check.1.in
head/security/pwned-check/files/pwned-check.sh.in
Modified: head/security/pwned-check/files/pwned-check.1.in
==============================================================================
--- head/security/pwned-check/files/pwned-check.1.in Sun Jul 29 04:31:44 2018 (r475627)
+++ head/security/pwned-check/files/pwned-check.1.in Sun Jul 29 06:53:06 2018 (r475628)
@@ -10,7 +10,7 @@
.Sh DESCRIPTION
The
.Nm
-utility checks the passwords piped in via standard input (one per line)
+utility checks the passwords piped in via standard input (one per line)
against a huge database of passwords that are known to have been stolen
in data breaches.
.Pp
@@ -22,6 +22,15 @@ on standard output and the exit status of
.Nm
is set to 1.
No output is generated for passwords not found in the database.
+.Pp
+The database can be downloaded to a local directory or it can be queried
+by a method that does not make the hash queried known to the remote
+server.
+The remote query is performed if the pawned password database has not
+been fetched and stored on the local system.
+While the remote accesses are not as fast as a local lookup, they will
+query an always up-to-date database and allow to avoid the download and
+storage of this huge database.
.Pp
Instead of plain passwords, SHA1 hashes of passwords may be supplied.
Matches will be reported, but there is no provision to report the
Modified: head/security/pwned-check/files/pwned-check.sh.in
==============================================================================
--- head/security/pwned-check/files/pwned-check.sh.in Sun Jul 29 04:31:44 2018 (r475627)
+++ head/security/pwned-check/files/pwned-check.sh.in Sun Jul 29 06:53:06 2018 (r475628)
@@ -82,14 +82,20 @@ exitcode=0
lookup ()
{
- local hash="$1"
- look "$hash" pwned-passwords*.txt > /dev/null
+ local hash=$(echo "$1" | tr 'a-z' 'A-Z')
+ if [ "$USEFILES" = yes ]; then
+ look "$hash" pwned-passwords*.txt > /dev/null
+ else
+ expected=${hash#?????}
+ prefix=${hash%$expected}
+ fetch -q -o - https://api.pwnedpasswords.com/range/$prefix 2>/dev/null | grep -i "^$expected:" >/dev/null
+ fi
}
checkpw ()
{
local pwd="$1"
- local hash=$(echo -n "$pwd" | sha1 | tr 'a-z' 'A-Z')
+ local hash=$(echo -n "$pwd" | sha1)
if lookup "$hash"; then
echo "$pwd"
exitcode=1
@@ -102,8 +108,10 @@ checkpw ()
}
# Main program
-cd "$DBDIR" || errexit "Database directory '$DBDIR' not found."
export LC_COLLATE=C
+if cd "$DBDIR" && ls pwned-passwords*.txt; then
+ USEFILES=yes
+fi >/dev/null 2>&1
if [ "$#" -gt 0 ]; then
if [ "$1" = "-u" ]; then
More information about the svn-ports-head
mailing list