Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

300M Freely Downloadable Pwned Passwords

troyhunt.com

Post reply on HN
Print view View original

51–60 of 184 posts

Re: 300M Freely Downloadable Pwned Passwords

#51

Post by peteretep »

user5994461 wrote: post #42
jessaustin wrote: post #34

Earlier quoted context omitted.

Yes it totally is true. Hashes are a standard length, and you can feed any length passphrase into the hash algorithm. It wouldn't surprise me to see passphrases limited to e.g. 256 chars anyway, but 27 smells very bad. What system limitation leads to this particular number? It smells like a DB column width to me.

Just because there is a limitation on password length doesn't imply they store the password in clear text.

It may not imply it, but it strongly suggests it.

Re: 300M Freely Downloadable Pwned Passwords

#52

Post by j_s »

tomschlick wrote: post #27
j_s wrote: post #24

Would it make sense to host the file on a cheap OVH/Scaleway VPS with unlimited bandwidth? I guess CloudFlare doing it for free beats that though!

"Unlimited" as in, "as soon as you start becoming a problem we drop you".

AFAIK these services are operate by ISPs with lopsided peering agreements.

Re: 300M Freely Downloadable Pwned Passwords

#53

Post by oliwarner »

An interesting element to this is how resistant some people are too using torrents for legitimate purposes, even as a backup mirror.

It's something we've come to embrace in the Linux world. Much faster than a single server and saves bandwidth at individual sites. Surprised this pragmatism hasn't reached the rest of you yet.

Re: 300M Freely Downloadable Pwned Passwords

#54

Post by jff »

oliwarner wrote: post #53

An interesting element to this is how resistant some people are too using torrents for legitimate purposes, even as a backup mirror. It's something we've come to embrace in the Linux world. Much faster than a single server and saves bandwidth at individual sites. Surprised this pragmatism hasn't reached the rest of you yet.

Having an http option makes it better for those on restrictive work networks--I'm downloading the file because I want to experiment with it, but I certainly wouldn't want a call from Networking asking why I'm torrenting stuff.

Re: 300M Freely Downloadable Pwned Passwords

#55

Post by Piskvorrr »

colinbartlett wrote: post #47

I do agree with Troy that this could be useful to send to relatives and family: > I'm envisaging more tech-savvy people using this service to demonstrate a point to friends, relatives and co-workers: "you see, this password has been breached before, don't use it!" But I can't be the only one whose family would be baffled by the term "pwned". I wish it said something like "Your password has been hacked!" which we all…

Too alarmist, and in wrong tense: people would start freaking out "by typing my password into this box, my password has been hacked". Resonance is not always a good thing, see Tacoma Narrows bridge ;)

Re: 300M Freely Downloadable Pwned Passwords

#56

Post by Piskvorrr »

user5994461 wrote: post #42
jessaustin wrote: post #34

Earlier quoted context omitted.

Yes it totally is true. Hashes are a standard length, and you can feed any length passphrase into the hash algorithm. It wouldn't surprise me to see passphrases limited to e.g. 256 chars anyway, but 27 smells very bad. What system limitation leads to this particular number? It smells like a DB column width to me.

Just because there is a limitation on password length doesn't imply they store the password in clear text.

It does not mean they store the password in clear text, but the implication is surely there. (It does not mean what you think it means.)

Re: 300M Freely Downloadable Pwned Passwords

#57

Post by 24gttghh »

peteretep wrote: post #3

I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?

KeePass uses an auto-type feature; wouldn't that simulate individual key presses, and defeat anti-paste mechanisms?

Re: 300M Freely Downloadable Pwned Passwords

#59

Post by Piskvorrr »

sillysaurus3 wrote: post #40
maaark wrote: post #38

Earlier quoted context omitted.

and storing plaintext passwords is unacceptable.

That's not true in every case. If you're just throwing it into a DB, then yes. But if you're encrypting it and storing it on an isolated server with the decryption keys on a separate server, it's not a huge deal. Look, people on HN make a massive deal about passwords. One of my most shocking discoveries starting as a pentester was that "storing passwords in plaintext" would be a low-severity finding at best . Medium…

If you're using the outlined method, you're very, very far from storing it in plain-text; much further than the woefully common `sha1(passwordtext) // voila, secure!`.

Re: 300M Freely Downloadable Pwned Passwords

#60

Post by Piskvorrr »

swiley wrote: post #4
peteretep wrote: post #3

I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?

Well for that you can probably turn off JavaScript or use the web inspector to enable paste.

And then the rest of the login stops working (and the character limit might be enforced again serverside, or worse, silently truncated). Plus, go try that on a smartphone.
Post reply on HN