Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

300M Freely Downloadable Pwned Passwords

troyhunt.com

Post reply on HN
Print view View original

31–40 of 184 posts

Re: 300M Freely Downloadable Pwned Passwords

#31

Post by saurik »

peteretep wrote: post #3

I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?

That is enough characters that if you restrict yourself to the ~95 normal printable characters you can obtain around 175 bits worth of password (as in, more than enough to store a SHA1 sum). Is that really not enough entropy for your use case?

Re: 300M Freely Downloadable Pwned Passwords

#32

Post by peteretep »

saurik wrote: post #31
peteretep wrote: post #3

I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?

That is enough characters that if you restrict yourself to the ~95 normal printable characters you can obtain around 175 bits worth of password (as in, more than enough to store a SHA1 sum). Is that really not enough entropy for your use case?

A constraint on password length is often suggestive that the password is not being stored securely.

Re: 300M Freely Downloadable Pwned Passwords

#33

Post by user5994461 »

peteretep wrote: post #32
saurik wrote: post #31

Earlier quoted context omitted.

That is enough characters that if you restrict yourself to the ~95 normal printable characters you can obtain around 175 bits worth of password (as in, more than enough to store a SHA1 sum). Is that really not enough entropy for your use case?

A constraint on password length is often suggestive that the password is not being stored securely.

That's simply not true.

Re: 300M Freely Downloadable Pwned Passwords

#34

Post by jessaustin »

user5994461 wrote: post #33
peteretep wrote: post #32

Earlier quoted context omitted.

A constraint on password length is often suggestive that the password is not being stored securely.

That's simply not true.

Yes it totally is true. Hashes are a standard length, and you can feed any length passphrase into the hash algorithm. It wouldn't surprise me to see passphrases limited to e.g. 256 chars anyway, but 27 smells very bad. What system limitation leads to this particular number? It smells like a DB column width to me.

Re: 300M Freely Downloadable Pwned Passwords

#36

Post by sillysaurus3 »

user5994461 wrote: post #33
peteretep wrote: post #32

Earlier quoted context omitted.

A constraint on password length is often suggestive that the password is not being stored securely.

That's simply not true.

Well, they're not wrong. Companies do store plaintext passwords as a customer service tradeoff. (A bad one, but they do it.) Chopping the length of a password to <32 chars is pretty correlated.

Re: 300M Freely Downloadable Pwned Passwords

#38

Post by maaark »

sillysaurus3 wrote: post #36
user5994461 wrote: post #33

Earlier quoted context omitted.

That's simply not true.

Well, they're not wrong. Companies do store plaintext passwords as a customer service tradeoff. (A bad one, but they do it.) Chopping the length of a password to <32 chars is pretty correlated.

and storing plaintext passwords is unacceptable.

Re: 300M Freely Downloadable Pwned Passwords

#39

Post by hedora »

peteretep wrote: post #3

I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?

Even worse than disable paste, I've noticed a lot of iPhone apps now require you to set a non-pasteable 4-6 digit pin to login (sometimes this is required to use the app at all, sometimes only if you enable touch id).

At least one bank says the pin is "for this device" but then accepts it on new iOS devices too (without ever prompting for the "real" password on the new device).

Re: 300M Freely Downloadable Pwned Passwords

#40

Post by sillysaurus3 »

maaark wrote: post #38
sillysaurus3 wrote: post #36

Earlier quoted context omitted.

Well, they're not wrong. Companies do store plaintext passwords as a customer service tradeoff. (A bad one, but they do it.) Chopping the length of a password to <32 chars is pretty correlated.

and storing plaintext passwords is unacceptable.

That's not true in every case. If you're just throwing it into a DB, then yes. But if you're encrypting it and storing it on an isolated server with the decryption keys on a separate server, it's not a huge deal.

Look, people on HN make a massive deal about passwords. One of my most shocking discoveries starting as a pentester was that "storing passwords in plaintext" would be a low-severity finding at best. Medium through critical vulns are reserved for findings that can own an app. That's how little password storage matters.

If you're relying on UPS preserving the secrecy of your 21-character master password that you're using across all your websites, you're doing it wrong. Yet the vast majority of users will do exactly that. The way to protect them is for critical services to use 2FA, which they do -- email, phone, insurance, etc all use 2FA or separate 4-digit passcodes now (USAA).

There have been so many password database leaks, yet the world moves forward. What is unacceptable is for Blue Cross to leak all your PII, yet the world moved on from that. CloudFlare leaked a huge amount of sensitive info. All of those matter way more than some password leaks.

If someone is going to target you, here's the most likely method: https://news.ycombinator.com/item?id=14919845

Post reply on HN