search

mihaifm / HIBPOfflineCheck

Keepass plugin that performs offline and online checks against HaveIBeenPwned passwords
Other
317 stars 17 forks source link

False positive #29

Closed Benoit87 closed 5 years ago

Benoit87 commented 5 years ago

The plugin (in offline use) gives always a "secured" answer even for basic passwords (12345678 / seen This 2,9M times in HIBP). Keepass v2.41 + Plugin v1.4.1. pwned-passwords-sha1-ordered-by-count-v4.txt in same folder as keepass.exe.

Someone could help me?

mihaifm commented 5 years ago

This probably needs more information: are you using any special settings, any other plugins? Can you make sure you’re not entering the password in the username field and leaving the actual password blank?

mihaifm commented 5 years ago

Also can you briefly activate Online mode and see what that does?

Benoit87 commented 5 years ago

I use also : keeAnywhere 1.5.1, KPScript 2.41, QR Code generator 2.0.12 and Quality column 1.2 (all uptodate)

Benoit87 commented 5 years ago

Password is entered in normal password field ("Mot de passe" in French translation).

mihaifm commented 5 years ago

Thanks for the update. Could you disable the other plugins and see if you still have problems? This way we will know for sure that it's a conflict with another plugin.

The only possibility for this plugin to show Secure for all passwords is that it somehow sees all passwords as blank, but I can't figure out how that's possible.

mihaifm commented 5 years ago

Hmm another possibility is that your password file is empty. Can you check that your file has the correct size?

Benoit87 commented 5 years ago

My passwor file is this : Nom: pwned-passwords-sha1-ordered-by-count-v4.txt Taille: 24303121452 octets SHA1: 4561F92092EAAD7DFE503F5A2E4AE56F2E5FFF51

Benoit87 commented 5 years ago

I've tested with all plugins deactivated (except HIBP). It doesn't work. Answer = Secure

mihaifm commented 5 years ago

Very weird. Did you try online mode? Perhaps you can also try an older release of the plugin?

jeff9315 commented 5 years ago

This is probably a stupid thing to ask @Benoit87 ... but just in case ... are you sure you're pointing to the correct location of the Pawned Password file?

Benoit87 commented 5 years ago

After many test it's now ok. I found that the file with hashes must be "SHA 1 / sorted by hashes" and not by prevalence. Thanks for your help.

mihaifm commented 5 years ago

Ah, yes, I didn’t spot the wrong filename in your original description. Good to hear it’s resolved.