300M Freely Downloadable Pwned Passwords • Hacker News Board

Re: 300M Freely Downloadable Pwned Passwords

#71

Post by aj7 » Thu, Aug 03, 2017, 4:50 PM UTC

If I test my passwords, aren't they also now pwned?

Re: 300M Freely Downloadable Pwned Passwords

#72

Post by Mithorium » Thu, Aug 03, 2017, 4:55 PM UTC

aj7 wrote: post #71

If I test my passwords, aren't they also now pwned?

In a word: Yes

Re: 300M Freely Downloadable Pwned Passwords

#73

Post by jlebrech » Thu, Aug 03, 2017, 4:57 PM UTC

Piskvorrr wrote: post #64

jlebrech wrote: post #17

Earlier quoted context omitted.

salt "your password" with https://www.passwordcard.org/en

"Pick a password length. Eight is pretty secure and usually acceptable." Wait, what? Unless you're suggesting that I append this to a password.

you can choose any area of the card, say 5 letters and a few keywords.

Re: 300M Freely Downloadable Pwned Passwords

#74

Post by stephengillie » Thu, Aug 03, 2017, 4:59 PM UTC

aj7 wrote: post #71

If I test my passwords, aren't they also now pwned?

Not if you grep locally. How big is this data set? It can't be much bigger than a AAA video game download.

Re: 300M Freely Downloadable Pwned Passwords

#75

Post by edelans » Thu, Aug 03, 2017, 5:05 PM UTC

aj7 wrote: post #71

If I test my passwords, aren't they also now pwned?

test the SHA1 of your passwords, not your passwords, and you are safe.

Re: 300M Freely Downloadable Pwned Passwords

#76

Post by edelans » Thu, Aug 03, 2017, 5:10 PM UTC

lancefisher wrote: post #41

nischalsamji wrote: post #35

HIBP provides a REST API to check if a password has been found in a breach, Is there a disadvantage of using it in applications and restricting users not to use the breached password?

It's not ideal to send every new user's password to a 3rd party service.

you can still send the SHA1

Re: 300M Freely Downloadable Pwned Passwords

#77

Post by rocqua » Thu, Aug 03, 2017, 5:14 PM UTC

edelans wrote: post #75

aj7 wrote: post #71

If I test my passwords, aren't they also now pwned?

test the SHA1 of your passwords, not your passwords, and you are safe.

A weak password can still be cracked given the sha1 hash and a dictionary.

Re: 300M Freely Downloadable Pwned Passwords

#78

Post by rocqua » Thu, Aug 03, 2017, 5:19 PM UTC

pjf wrote: post #23

Someone should apply deep learning to this and check how it compares with brute-forcing passwords. E.g. https://github.com/thoppe/5baa61e4c9b93f3f0682250b6cf8331b7e...

Can't, as the passwords aren't available in plain-text. Only as sha-1 hashes.

Re: 300M Freely Downloadable Pwned Passwords

#79

Post by ocdtrekkie » Thu, Aug 03, 2017, 5:23 PM UTC

stephengillie wrote: post #74

aj7 wrote: post #71

If I test my passwords, aren't they also now pwned?

Not if you grep locally. How big is this data set? It can't be much bigger than a AAA video game download.

It's 11.9 GB of text (5.3 GB zipped). So smaller than quite a few video game downloads.

Re: 300M Freely Downloadable Pwned Passwords

#80

Post by loginx » Thu, Aug 03, 2017, 5:25 PM UTC

peteretep wrote: post #3

I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?

You think that's bad? My damn BANK has the following password policy for online banking:

  The password you create here can be used to access Online, Mobile and Telephone Banking.
  All passwords must be six characters in length. Special characters (eg. *, %, $, etc) will not be accepted.