search

originaluko / haveibeenpwned

Identify pwned accounts and passwords via the "Have I been pwned?" (https://haveibeenpwned.com) API.
MIT License
57 stars 18 forks source link

Update Get-PwnedPassword to use K-anonymity only #1

Closed plaintextcity closed 6 years ago

plaintextcity commented 6 years ago

Troy announced that direct hash and password searches will be deprecated.

https://www.troyhunt.com/enhancing-pwned-passwords-privacy-by-exclusively-supporting-anonymity/

This is great but would break the existing API methods. I updated the script to use range checking. In line with Troy's changes, I recommend removing the -password option and requiring securestring or sha1 only, but defer that to the owner.