101–110 of 184 posts
>If a password is not found in the Pwned Passwords set, it'll result in a response like this: Wait, so I test my password to see if it's "good" and now you have a copy of a password I will be using. Am I just being paranoid?
You can post the sha1sum instead. $ sha1sum SooperSekretPassw0rd^D SooperSekretPassw0rddc0d3504b259a92dce59b850969601d12c06a75f -
I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…
I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…
I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…
I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…
Email address is stupid, we should have randomly generated proxy email addresses.
I don't get it. >Do not send any password you actively us to a third-party service - even this one. So I can only test password that I am not using (and by extension that I am not going to use in the future). >oh no - pwned! >This password has previously appeared in a data breach and should never be used. If you've ever used it anywhere before, change it immediately! If I cannot (shouldn't) submit any password I am a…
I believe the idea is to ensure no one can use the listing to brute force.
The gp makes a good point, but that's also why you can submit the `sha1($your_password)` instead. The only question is why did Troy allow un-hashed passwords to be submitted.
I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…
Why pipe to md5sum?
Anyway, as far as password creation goes, here's another alternative based on more standard tools:
head -c NN /dev/urandom | base32 # or base64, or md5sum if you so prefer>If a password is not found in the Pwned Passwords set, it'll result in a response like this: Wait, so I test my password to see if it's "good" and now you have a copy of a password I will be using. Am I just being paranoid?
This is Troy we're talking about - I strongly doubt he'd do anything like that without full disclosure.
Maybe a malicious copy of the website exists at lots of LevenshteinDist=1 domains. Accidentally typo the domain and get pwned, thinking you are submitting it to an ethical security researcher's tool, but actually getting phished.
I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…
Why pipe to md5sum?
(note for people who may not know pwgen : it outputs 20 lines of 8 random passwords)