Help Your Users to Not Get Pwned

The indefatigable Troy Hunt ��� publisher of the ���Have I Been Pwned?���
site, also has a site and Web service API called Pwned Passwords.
You can use this to check a candidate password to see if it has been used before���
in one of the many hacked credential dumps that Mr. Hunt has accumulated.

Mostly, this API will be of interest for Web sites and Web services that allow
users to create their own password-protected accounts. You can rapidly check
the user���s candidate password to see if has already been pwned, perhaps rejecting
it if it has.

There will be scenarios where you want to check this client-side, though:

Your Android team can move faster than your Web service team, and so you would
like to check for pwnage on the client side now, while waiting for the Web
service team to integrate the check on their side

The password will be used for files that mostly will remain local on the device,
but might be published somewhere, using the supplied password as part of an
encryption scheme

You want to integrate pwnage checking into your Android-based password safe

And so on

The Pwned Passwords Web service API is fairly straightforward. There are two
modes, one where you submit the actual password, and one where you submit the
first five characters of the SHA-1 hash of the password. That latter case is
more private, in that you don���t give Mr. Hunt your user���s password. While
Mr. Hunt surely wouldn���t use that information, he is Australian, and
cockatoos there have a remarkable interest in Internet connectivity,
and you wouldn���t want your users password in the, um, claws of a rogue
cockatoo.

Besides, shipping passwords over the Internet unnecessarily is just uncool.

This Java class
uses OkHttp and RxJava to let you check a password for pwnage. If you get back
0, then all is well. A positive number represents the number of times that
password occurs in Mr. Hunt���s database. Whether you reject the password for
any positive value, or only for a value that exceeds some threshold, is up to
you. It uses the SHA-1 hash approach, and so the password itself does not
leave the device.

The class is lightly tested, so YMMV, but it���s a starting point for you to
use for crafting your own on-device access to the Pwned Passwords. And, a variation
on this class might show up in a sample app in a book
at some point. Just sayin���.