adewes / have-i-been-bloomed Goto Github PK

Hi! Thanks for this great piece of work - wouldn't be comfortable sending my users' passwords to anyone's API - not even as hashed to Troy's API. So I am trying to contribute by putting this to Docker format and sharing it via Docker hub. But I have noticed two things, one of which I could resolve on my own but the second one persists. When I try to run "hibb" the following error is produced (Docker image is based on Ubuntu 18.04):
`
/root/go/bin/hibb

Loading Bloom filter from pwned-passwords-2.0.bloom...
Invalid version bit (should be 1)
`
Can't really figure this one out because I am not that familiar with go - could you help? This might not be a bug, but at this time, but still... Below is what I could find from cache. Thanks!

BR, Jari

--- SNIP ---

// Read loads a filter from a reader object.
func (s *BloomFilter) Read(input io.Reader) error {GoCover_0_656131393636393837346564.Count[0] = 1;
        bs8 := make([]byte, 8)

        if _, err := io.ReadFull(input, bs8); err != nil {GoCover_0_656131393636393837346564.Count[10] = 1;
                return err
        }

        GoCover_0_656131393636393837346564.Count[1] = 1;flags := binary.LittleEndian.Uint64(bs8)

        if flags&0xFF != 1 {GoCover_0_656131393636393837346564.Count[11] = 1;
                return fmt.Errorf("Invalid version bit (should be 1)")
        }

200 OK should be reserved for connection handling: using status 418 should be removed. This makes it easier for the frontend devs to use the API. Please, make server to return application/json instead of HTTP status code.

If password is found/not found , message body should be {"found": true | false} with HTTP 200 status code and MIME-type application/json.

Problem: hibb uses password file version 2 although version 6 is already available. However, hibb uses 2.0 references, which makes updates difficult.

Solution proposal:

• introduce one variable that contains a (fixed) URL, which means it is relatively easy to change it. wget should use it.
• rename the downloaded file to a version independent name e.g. pwned-passwords.txt.7z using "mv" or "wget -O new_file_name http://your_url.com way"
• replace references containing "pwned-passwords-2.0" with "pwned-passwords"

Hello Andres,

I like your project and would like to use it. However, I saw that you did not add a license. This means that I cannot use the program. If you want other developers to use it you should add a license. Here is a good guide for this:
https://choosealicense.com/
The MIT license would allow me to use and customize your code.

Best regards
Reinhard