Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

300M Freely Downloadable Pwned Passwords

troyhunt.com

Post reply on HN
Print view View original

91–100 of 184 posts

Re: 300M Freely Downloadable Pwned Passwords

#91

Post by oelmekki »

I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that.

Currently, my way to generate a new password is this : `pwgen | md5sum`. And then, I use "lost password" everywhere (but for my mailbox, obviously), that is, the rare times my browser is not already prefilling the login form.

This makes me wonder why we don't just go with that : generate a random password for the user in registration form, allow the browser to save it. On the login form, check if fields are prefilled. If not, only display an email field and send an auth link as mail. User clicking it (once, and fast enough) is logged in.

You still have to remember your mailbox password, but that's the only one, quite akin the root password of a server.

Re: 300M Freely Downloadable Pwned Passwords

#92

Post by blacksmith_tb »

loginx wrote: post #80
peteretep wrote: post #3

I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?

You think that's bad? My damn BANK has the following password policy for online banking: The password you create here can be used to access Online, Mobile and Telephone Banking. All passwords must be six characters in length. Special characters (eg. *, %, $, etc) will not be accepted.

Banks are some of the worst - though oddly in many cases I've seen them support much more complex usernames than passwords. If you use a password manager you can generate large, random usernames to go with your tiny, weak password, potentially.

Re: 300M Freely Downloadable Pwned Passwords

#93

Post by wongarsu »

captn3m0 wrote: post #15
developer2 wrote: post #10

Earlier quoted context omitted.

Is a bloom filter worth it in this case? With the optimal "k" hash functions of 10 and a "p" error rate of 0.001% (false positives of approximately 1 in 1000), a bloom filter for the 306,259,512 items will take 538 MB. Increasing the error rate to 0.01% (1 in 100) is still 358 MB. That's a sizeable filter to maintain in memory (then again... RAM is cheap). I'd probably just shove the passwords into a database, limiti…

Distributing a 538 MB file (which can be compressed further) is much easier.

What are the actual use cases where this size difference matters?

I distributing to a general audience, 0.5GB and 10GB isn't that much of a difference, and most people are more equipped for handling lists of strings than for handling bloom filters.

Re: 300M Freely Downloadable Pwned Passwords

#94

Post by joatmon-snoo »

excitom wrote: post #88

>If a password is not found in the Pwned Passwords set, it'll result in a response like this: Wait, so I test my password to see if it's "good" and now you have a copy of a password I will be using. Am I just being paranoid?

This is Troy we're talking about - I strongly doubt he'd do anything like that without full disclosure.

Re: 300M Freely Downloadable Pwned Passwords

#95

Post by mnem »

excitom wrote: post #88

>If a password is not found in the Pwned Passwords set, it'll result in a response like this: Wait, so I test my password to see if it's "good" and now you have a copy of a password I will be using. Am I just being paranoid?

From the article: "It goes without saying (although I say it anyway on that page), but don't enter a password you currently use into any third-party service like this! I don't explicitly log them and I'm a trustworthy guy but yeah, don't."

Re: 300M Freely Downloadable Pwned Passwords

#96

Post by rrauenza »

excitom wrote: post #88

>If a password is not found in the Pwned Passwords set, it'll result in a response like this: Wait, so I test my password to see if it's "good" and now you have a copy of a password I will be using. Am I just being paranoid?

You can post the sha1sum instead.

  $ sha1sum
  SooperSekretPassw0rd^D
  SooperSekretPassw0rddc0d3504b259a92dce59b850969601d12c06a75f  -

Re: 300M Freely Downloadable Pwned Passwords

#97

Post by wongarsu »

edelans wrote: post #76
lancefisher wrote: post #41

Earlier quoted context omitted.

It's not ideal to send every new user's password to a 3rd party service.

you can still send the SHA1

Without salt, meaning the majority of passwords can be reversed with brute-forcing or rainbow tables.

The second google result for rainbow tables lets me download software and tables to efficiently reverse any sha1 whos plaintext fits [a-zA-Z0-9]{1,9} or [a-z0-9]{1,10}. That's likely the majority of passwords an attacker would observe

Re: 300M Freely Downloadable Pwned Passwords

#98

Post by sleepybrett »

loginx wrote: post #80
peteretep wrote: post #3

I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?

You think that's bad? My damn BANK has the following password policy for online banking: The password you create here can be used to access Online, Mobile and Telephone Banking. All passwords must be six characters in length. Special characters (eg. *, %, $, etc) will not be accepted.

get a new bank, then tell them why.

Re: 300M Freely Downloadable Pwned Passwords

#99

Post by sleepybrett »

ocdtrekkie wrote: post #79
stephengillie wrote: post #74

Earlier quoted context omitted.

Not if you grep locally. How big is this data set? It can't be much bigger than a AAA video game download.

It's 11.9 GB of text (5.3 GB zipped). So smaller than quite a few video game downloads.

fairly low compression rate for zipped ascii, but i guess it is mostly a giant pile of nearly random strings.

Re: 300M Freely Downloadable Pwned Passwords

#100

Post by model_m_warrior »

jaclaz wrote: post #86

I don't get it. >Do not send any password you actively us to a third-party service - even this one. So I can only test password that I am not using (and by extension that I am not going to use in the future). >oh no - pwned! >This password has previously appeared in a data breach and should never be used. If you've ever used it anywhere before, change it immediately! If I cannot (shouldn't) submit any password I am a…

I believe the idea is to ensure no one can use the listing to brute force.
Post reply on HN