With all the data we collect (as you can read in details in my previous article) the challenge is not to figure out what to do with the data, but the implementation of the idea itself. When we have access to so many passwords, it was only a matter of time to implement some kind of search for passwords that show up in incident records. And this one wasn’t so complex either. We bring to you today a Password Checker with brand new release v1.2.0 of Sentinel View.
Password Checker
It is as simple as it sounds, and you probably know this is not a new idea, I hope you are familiar with the Have I Been Pwned service. We do it similarly, but from our own data pool. It is possible to check whether any of your passwords had been used by bad players or bots in Sentinel View. You will get the general count, and some information, like from which minipot did that record came. You should at first try the obvious passwords to give it a run-dry and get similar result to mine. At last but not least, we also borrowed the API interface design from the Have I Been Pwned.
The API
The programmer stuff…
The Sview frontend does not simply send your password to our backend. That is not happening. And even if the communication between your front end and our API wouldn’t go over https (and still it’s not that case), everything is perfectly safe. As I stated above we borrowed the idea directly from Have I Been Pwned API specification.
Follow the schema with the help of a few words. First you input your sacred password, the password is hashed using sha1 hash. Than the first 6 bytes are queried from DB on backend. All results for this very query are returned to browser and the frontend checks if any of the full hashes matches the hash of your password.
Is it all there is to it?
Well, it isn’t. If you followed the schema and you are programmer and you want to include our results in your project, you are free to use our API without limitations. Yes, we also release API along with the search box. The only limitation is to query in some reasonable manner. If you spam the API, you’ll get blocked.
Let me remind you, we make router updated pretty regularly, and yes, you have firewall with greylist that updates in seconds. But it’s the small things like this that make us happy. On the top of that, you have now access to ever growing list of random strings that won’t tell you much, unless you try all of them. Ain’t that fun?