Currently, for convenience, this tool allows users to check the passwords of a KeePass database against the HaveIBeenPwned Pwned Passwords list. Users can perform this check in one of two ways:
1. ONLINE HIBP Check
This tool takes the first 5 characters of the hash of a password, and sends it to HaveIBeenPwned servers via the service's API. A number of potential matches come back, at which point the tool searches for an exact match (which would indicate an exposed password). As explained in the API documentation:
When a password hash with the same first 5 characters is found in the Pwned Passwords repository, the API will respond with an HTTP 200 and include the suffix of every hash beginning with the specified prefix, followed by a count of how many times it appears in the data set. The API consumer can then search the results of the response for the presence of their source hash and if not found, the password does not exist in the data set.
Note: I currently force users to give explicit permission to perform this check:
println!("\n\nHeads up! I'll be sending the first 5 characters of the hashes of your passwords over the internet to HaveIBeenPwned. \nType allow to allow this");
if gets().unwrap() == "allow" {
println!("Cool, I'll check your KeePass passwords over the internet now...\n");
// ...
2. OFFLINE HIBP Check
The tool also allows users to perform this check entirely offline, however the user must first download the ~11GB exposed passwords list themselves, then provide that text file to this tool so it can do the check. To execute this procedure, this tool does not need to connect to the internet.
For a variety of reasons, the OFFLINE method is more secure. Even though the ONLINE method only sends 5 characters of a hash of user passwords, that's still more than nothing.
Thus I'm thinking of removing the ONLINE option (option 2). This way the entire tool never connects to the internet, which would be more in line with how KeePassXC, a commonly used application for interacting with KeePass databases, works by default (except features like "Download favicon").
I could even put a "paranoid" check in place such that tool can't open a KeePass database if it's able to connect to the internet, forcing the user to disable their internet connection in order to use the tool at all.
Questions
What do you think? Should I offer the ONLINE check at all? Make it harder to access somehow?
Are you less likely to use this tool because there's an option to send 5 characters of your passwords' hashes over the internet? Does removing that feature in order to allay these security concerns provide a net benefit that outweighs the usefulness of the online check?