skarbiec breach sites

Invocation#

skarbiec breach sites

Purpose#

Find the passwords a site's breach may have taken and that are still in use, so they are changed first.

Required inputs and options#

• No arguments. Which sites were breached, and on which day, is read from Have I Been Pwned's public list of breaches, https://haveibeenpwned.com/api/v3/breaches, downloaded whole with curl and needing no key; nothing from the vault is sent, not even a site name. When each password was last set is password age's answer. POST /v1/operator/items/site-breaches takes no body.

Output and state effects#

• Matches the sites every live login's context names against each breach's domain, a site matching its subdomains too; a breach that names no domain is passed over. A login whose password was set before the breach day, or on it, is listed under exposed; one whose password changed after it under changed_since. Each row names item, site, breach (the list's name for it), breach_date and password_set_at. Prints ok (false when a login is exposed or could not be judged), exposed, changed_since, unreadable (each login that would not open or whose password could not be dated, with why), source and attribution, the Creative Commons Attribution 4.0 credit the list's licence asks for. Writes nothing; generate --into <id> --field password replaces an exposed password, and Desktop's Settings → Policy shows the list as Breached sites.

Refusals#

• A list that cannot be reached fails with `the Have I Been Pwned breach list at <address> could not be read (<curl status>): <curl's reason>; no login was judged`; an answer that is not a list, or a breach with a domain and no Name or BreachDate, fails naming it. Any argument exits 2 with `usage: breach sites`. Passwords never appear in the answer.