Pwned Passwords are hundreds of millions of real world passwords exposed in
data breaches. This exposure makes them unsuitable for ongoing use as they
are at much greater risk of being used to take over other accounts.
This script offers 2 methods to check whether a password has been exposed
in an uncovered breach:
1) Online check implemented in such a way that the password to be checked
does not need to be sent to the remote database server.
2) Local check against a copy of the pawned passwords database.
Since the local copy of the database requires nearly 20 GB of disk space
(and a download of more than 10 GB of compressed data) the access via the
online check should be preferred, if the compatible with operational and
security requirements.
Remove WWW entries moved into port Makefiles
Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.
This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.
Approved by: portmgr (tcberner)
Add WWW entries to port Makefiles
It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.
Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.
There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.
(Only the first 15 lines of the commit message are shown above )
security: remove 'Created by' lines
A big Thank You to the original contributors of these ports:
* <ports@c0decafe.net>
* Aaron Dalton <aaron@FreeBSD.org>
* Adam Weinberger <adamw@FreeBSD.org>
* Ade Lovett <ade@FreeBSD.org>
* Aldis Berjoza <aldis@bsdroot.lv>
* Alex Dupre <ale@FreeBSD.org>
* Alex Kapranoff <kappa@rambler-co.ru>
* Alex Samorukov <samm@freebsd.org>
* Alexander Botero-Lowry <alex@foxybanana.com>
* Alexander Kriventsov <avk@vl.ru>
* Alexander Leidinger <netchild@FreeBSD.org>
(Only the first 15 lines of the commit message are shown above )
security/pwned-check: Remove spaces from sample config file
It contains unnecessary spaces, which results in the following error
messages on command execution.
$ pwned-check
/usr/local/etc/pwned-check.conf: /var/db/pwned-check: Permission denied
/usr/local/etc/pwned-check.conf: https://downloads.pwnedpasswords.com/passwords:
not found
PR: 228635
Submitted by: Hiroki Tagato <tagattie@yandex.com>
Approved by: se (maintainer timeout, ~7 months)
Add support for the remote query API. This obviates the need to download
the > 10 GB pawned password hash list, which requires nearly 20 GB after
decompression.
The API does not transfer the queried password or its full SHA1 hash to
the server, but only the first 5 characters of the hash. This allows to
retrieve the full password hashes that match that prefix (typically in the
order of 500) and then to check whether the password to test matches any
of the hashes returned.
Approved by: antoine (implicit)
Bump port-epoch after an attempted update to support the new revision of
the data files had to be reverted. The new file format is incompatible
and no longer suitable for quick lookup of the password hashes. Sorting
the 30 GB file into a usable form took more than 4 hours on my system,
which seems impractical. The port will therefore stay on the level of the
"old" data files.
Approved by: antoine (implicit)
Revert previous commit. The format of the passwort hash database files
has been changed and entries are no longer sorted.
PORTEPOCH is not incremented, since only a few minutes passed after the
commit of the revoked upate.
Approved by: antoine (implicit)
Update to use newly released database of pawned passwords (2.5 times the
number of passwords covered, compared to the previous version).
Approved by: antoine (implicit)
This script uses a downloaded copy of the pwned passwort hashes available
from https://haveibeenpwned.com/Passwords/ to allow passwords to be locally
checked, whether they are known to have been obtained in a data breach and
therefore should not be used.
Approved by: Antoine (mentor)
