this post was submitted on 17 Jun 2026
118 points (99.2% liked)
Privacy
49209 readers
714 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 6 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
I read the article for the information, but the thing I really want to comment on is this box on the page:
I have ads blocked, but this is in the middle of the article, so I don't know if it's affiliated with the site or if it's an ad that slipped through the cracks. Either way, wtf?
Yeah, sure anonymous box, I totally trust you! Here, take all my passwords!
Honestly suspicious and makes me think the whole site is a trap
ah shit my password
I mean, it does seem to do something. I generated a random one and it told me it was safe. For now! The box then told me to get a password manager with a link to its own password managers article and set up 2FA. The password manager list is just a collection of affiliate links with filler text btw.
If someone wants to figure out what the site sends to figure this stuff out and if it's more than just rockyou.txt, go ahead.
F12 reports using that tool sends the password as a form body field to their site (which means their server can read the request in plain text), which responses a json with just a field of how many "matches".
There's no way to know whether they log the requests (so you should assume they do in uncertainty like this), but it certainly does the real thing of comparing it against a "leaked password" database in their servers. (If you want to check against these, there are real password dumps with list of leaked passwords you can ctrl+f yourself in your own PC, but even then they are likely not complete list as there still exist other database leaks of hashes where your password is not bruteforced yet to be put in plaintext but someone with more time might have gotten to it)
YIKES