Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > alt.os.linux.mageia > #20234

Re: Accessing Hunt's pwned database.

Cross-posted to 2 groups.

Show all headers | View raw

On 2019-01-30, Richard Kettlewell <invalid@invalid.invalid> wrote:
> Jasen Betts <jasen@xnet.co.nz> writes:
>> Richard Kettlewell <invalid@invalid.invalid> wrote:
>>> William Unruh <unruh@invalid.ca> writes:
>>>> Here is a bash script to impliment this. 
>>>>
>>>> #!/bin/bash -x
>>>> T=/tmp/t1
>>>> read -s -p Password: passwd
>>>> echo
>>>> hash=`echo -n "$passwd"|sha1sum|tr 'a-f' 'A-F'|sed 's/^...../& /g'`
>>>
>>> This not a secure approach. The candidate password will briefly appear
>>> in ps output.

I did think of that but also know that the amount of time it does so is
very small, but could not think of a way of doing so with my knowledge. 
>>
>> hash = $( (tr -d $'\n' << pwd
>> $passwd
>> pwd
>> ) | sha1sum | tr 'a-f' 'A-F'|sed 's/^...../& /g')
>>
>>
>> blech!
>>
>> maybe there's a better way.
>
> There is: use a more sensible language than shell.

Helpful aren't you?
When a hammer is the only tool you have you have to make everything look
like a nail. One of the key things I want is that almost anyone can look
at the program and see exactly what it does. Anyone that uses a program
to ship out passwords to unknown places in the world (and I and 99.9999%
of the world have no idea who Troy Hunt is or how reliable he is-- and
this is NOT an invitation for anyone to tell me) should know exactly and
easily how the program is handling the password.  A bash scipt does
that. Troy's web pages do not. 

>

Back to alt.os.linux.mageia | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Accessing Hunt's pwned database. William Unruh <unruh@invalid.ca> - 2019-01-29 18:24 +0000
  Re: Accessing Hunt's pwned database. Jasen Betts <jasen@xnet.co.nz> - 2019-01-30 02:54 +0000
  Re: Accessing Hunt's pwned database. Richard Kettlewell <invalid@invalid.invalid> - 2019-01-30 08:59 +0000
    Re: Accessing Hunt's pwned database. Jasen Betts <jasen@xnet.co.nz> - 2019-01-30 10:47 +0000
      Re: Accessing Hunt's pwned database. Richard Kettlewell <invalid@invalid.invalid> - 2019-01-30 11:05 +0000
        Re: Accessing Hunt's pwned database. William Unruh <unruh@invalid.ca> - 2019-01-30 18:06 +0000
          Re: Accessing Hunt's pwned database. Richard Kettlewell <invalid@invalid.invalid> - 2019-01-30 20:02 +0000
            Re: Accessing Hunt's pwned database. William Unruh <unruh@invalid.ca> - 2019-01-30 22:41 +0000
              Re: Accessing Hunt's pwned database. Richard Kettlewell <invalid@invalid.invalid> - 2019-01-31 08:24 +0000
                Re: Accessing Hunt's pwned database. William Unruh <unruh@invalid.ca> - 2019-01-31 16:50 +0000
                Re: Accessing Hunt's pwned database. Richard Kettlewell <invalid@invalid.invalid> - 2019-02-01 14:19 +0000
                Re: Accessing Hunt's pwned database. Jim Beard <jim.beard@verizon.net> - 2019-02-01 14:45 +0000
                Re: Accessing Hunt's pwned database. Richard Kettlewell <invalid@invalid.invalid> - 2019-02-01 15:06 +0000
          Re: Accessing Hunt's pwned database. "Carlos E.R." <robin_listas@es.invalid> - 2019-01-30 23:23 +0100
            Re: Accessing Hunt's pwned database. William Unruh <unruh@invalid.ca> - 2019-01-30 22:43 +0000
              Re: Accessing Hunt's pwned database. "Carlos E.R." <robin_listas@es.invalid> - 2019-01-31 03:03 +0100
                Re: Accessing Hunt's pwned database. William Unruh <unruh@invalid.ca> - 2019-01-31 02:11 +0000
      Re: Accessing Hunt's pwned database. William Unruh <unruh@invalid.ca> - 2019-01-30 20:16 +0000
      Re: Accessing Hunt's pwned database. Jasen Betts <jasen@xnet.co.nz> - 2019-01-31 03:08 +0000
        Re: Accessing Hunt's pwned database. William Unruh <unruh@invalid.ca> - 2019-01-31 04:18 +0000

csiph-web