Properly generated passwords are significantly rarer than other types though, because it's much harder to crack the hashes for them. So in the case of non-plaintext breaches, you'll see far fewer.<div><br></div><div>Cheers,</div><div>Steve<br><br><div class="gmail_quote"><div dir="ltr">On Fri, 18 Jan 2019, 22:14 Tristan Miller, <<a href="mailto:psychonaut@nothingisreal.com">psychonaut@nothingisreal.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Greetings.<br>
<br>
On Thu, 17 Jan 2019 14:48:04 -0800, Pass Word<br>
<<a href="mailto:passwordstore@89vx.net" target="_blank">passwordstore@89vx.net</a>> wrote:<br>
> Someone asked on irc today for an option to check passwords against<br>
> the Have I Been Pwned website to see if they are already<br>
> compromised. It is probably extremely rare for a password generated<br>
> with pass to already be on there but whatever, it is still somewhat<br>
> useful to check other passwords you might have stored in pass.<br>
<br>
I wouldn't say that finding a pass-generated password listed on Have I<br>
Been Pwned is "extremely rare" -- the breaches recorded there<br>
come from websites that stored passwords insecurely (such as in<br>
plaintext). So no matter how secure a password you chose for such a<br>
website, it will still be catalogued on HIBP.<br>
<br>
I do generate all my passwords randomly, and use a unique password on<br>
each site. Still, it's important for me to know if any of these are<br>
compromised so that I can change the password on the affected site.<br>
Thanks to the other posters in this thread for sharing the tools they<br>
use to mass-check the password store against HIBP in a secure way.<br>
<br>
Regards,<br>
Tristan<br>
<br>
-- <br>
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-<br>
Tristan Miller<br>
Free Software developer, ferret herder, logologist<br>
<a href="https://logological.org/" rel="noreferrer" target="_blank">https://logological.org/</a><br>
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-<br>
_______________________________________________<br>
Password-Store mailing list<br>
<a href="mailto:Password-Store@lists.zx2c4.com" target="_blank">Password-Store@lists.zx2c4.com</a><br>
<a href="https://lists.zx2c4.com/mailman/listinfo/password-store" rel="noreferrer" target="_blank">https://lists.zx2c4.com/mailman/listinfo/password-store</a><br>
</blockquote></div></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><p dir="ltr">Cheers,</p>
<p dir="ltr"><b>Steve Gilberd</b><br>
<span style="color:rgb(102,102,102)">Erayd LTD </span><span style="color:rgb(102,102,102)"><b>·</b></span><span style="color:rgb(102,102,102)"> Consultant</span><br>
<span style="color:rgb(102,102,102)"><i>Phone: +64 4 974-4229 </i></span><span style="color:rgb(102,102,102)"><i><b>·</b></i></span><span style="color:rgb(102,102,102)"><i> Mob: +64 27 565-3237</i></span><br>
<span style="color:rgb(102,102,102)"><i>PO Box 10019, The Terrace, Wellington 6143, NZ</i></span></p>
</div></div>