300M Freely Downloadable Pwned Passwords
troyhunt.com
300M Freely Downloadable Pwned Passwords
1–10 of 184 posts
Re: 300M Freely Downloadable Pwned Passwords
#2Going to generate a bloom-filter from this dataset tonight.
Troy mentions some arguments against torrents, but it is better to have a authoritative torrent than none, imo.
Re: 300M Freely Downloadable Pwned Passwords
#3I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field.
Who do we lobby to get them to fail their next PCI-DSS compliance test?
Re: 300M Freely Downloadable Pwned Passwords
#4I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?
Well for that you can probably turn off JavaScript or use the web inspector to enable paste.
Re: 300M Freely Downloadable Pwned Passwords
#5Is it safe to test my password on this website? (because I just did)
Re: 300M Freely Downloadable Pwned Passwords
#6I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?
PCI-DSS still recommends password expiry, rotation, and complexity rules. If you undergo certification, send a mail to them and let them know that you prefer the NIST guidelines.
Might happen in the next version release.
Re: 300M Freely Downloadable Pwned Passwords
#7Is it safe to test my password on this website? (because I just did)
From the article:
"It goes without saying (although I say it anyway on that page), but don't enter a password you currently use into any third-party service like this! I don't explicitly log them and I'm a trustworthy guy but yeah, don't."
Safe: probably. Good practice: no.
Re: 300M Freely Downloadable Pwned Passwords
#8Is it safe to test my password on this website? (because I just did)
If you only have one password to try, I'd say you have more important issues to tackle. Install a password manager, start using generated passwords, and stop using 'your password'.
Re: 300M Freely Downloadable Pwned Passwords
#9Is it safe to test my password on this website? (because I just did)
If you only have one password to try, I'd say you have more important issues to tackle. Install a password manager, start using generated passwords, and stop using 'your password'.
Well, in that case, “your password” might be the only one you have – the one use for your password manager.
Re: 300M Freely Downloadable Pwned Passwords
#10Going to generate a bloom-filter from this dataset tonight. Troy mentions some arguments against torrents, but it is better to have a authoritative torrent than none, imo.
Is a bloom filter worth it in this case? With the optimal "k" hash functions of 10 and a "p" error rate of 0.001% (false positives of approximately 1 in 1000), a bloom filter for the 306,259,512 items will take 538 MB. Increasing the error rate to 0.01% (1 in 100) is still 358 MB. That's a sizeable filter to maintain in memory (then again... RAM is cheap).
I'd probably just shove the passwords into a database, limiting the index prefix to the first X characters to reduce index size.