Remove tag consumer-protection
article thumbnail

Understanding Have I Been Pwned's Use of SHA-1 and k-Anonymity

Troy Hunt

More than a decade ago now, I wrote about how Our Password Hashing Has no Clothes and in that post, showed the massive rate at which consumer-grade hardware can calculate these hashes and consequently "crack" the password. The 1 hash that won't yield any search results (until Google indexes this blog post.) is the middle one.

Passwords 123