Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

300M Freely Downloadable Pwned Passwords

troyhunt.com

Post reply on HN
Print view View original

121–130 of 184 posts

Re: 300M Freely Downloadable Pwned Passwords

#121

Post by agwa »

oelmekki wrote: post #110
lorenzk wrote: post #104

Earlier quoted context omitted.

Why pipe to md5sum?

I could just pass an option to make pwgen generate longer passwords, really, but I find amusing the idea of generating the hash of 160 urandom level generated passwords :) Now that's random! Oh, and also, it looks like a hashed password, so special troll points if a cracker find the password and think it's its hash. (note for people who may not know pwgen : it outputs 20 lines of 8 random passwords)

> (note for people who may not know pwgen : it outputs 20 lines of 8 random passwords)

Unfortunately, it only does this if STDOUT is a TTY. If it's a pipe, then it outputs a single 8 character long password. So I'm afraid you've been generating rather low entropy passwords by piping the output of pwgen through md5sum.

You can confirm this by piping pwgen through cat: pwgen | cat

Re: 300M Freely Downloadable Pwned Passwords

#122

Post by Spivak »

sleepybrett wrote: post #98
loginx wrote: post #80

Earlier quoted context omitted.

You think that's bad? My damn BANK has the following password policy for online banking: The password you create here can be used to access Online, Mobile and Telephone Banking. All passwords must be six characters in length. Special characters (eg. *, %, $, etc) will not be accepted.

get a new bank, then tell them why.

I'm sure they will be heartbroken.

Re: 300M Freely Downloadable Pwned Passwords

#123

Post by bradleyjg »

captn3m0 wrote: post #15
developer2 wrote: post #10

Earlier quoted context omitted.

Is a bloom filter worth it in this case? With the optimal "k" hash functions of 10 and a "p" error rate of 0.001% (false positives of approximately 1 in 1000), a bloom filter for the 306,259,512 items will take 538 MB. Increasing the error rate to 0.01% (1 in 100) is still 358 MB. That's a sizeable filter to maintain in memory (then again... RAM is cheap). I'd probably just shove the passwords into a database, limiti…

Distributing a 538 MB file (which can be compressed further) is much easier.

>which can be compressed further

Can it? I think of a bloom filter as similar to a lossy compression scheme and wouldn't expect it to be further compressible to any significant extent using a general purpose lossless scheme. Similar to how general purpose compressors generally don't do very well with mp3s or jpgs.

Re: 300M Freely Downloadable Pwned Passwords

#124

Post by aeorgnoieang »

sillysaurus3 wrote: post #40
maaark wrote: post #38

Earlier quoted context omitted.

and storing plaintext passwords is unacceptable.

That's not true in every case. If you're just throwing it into a DB, then yes. But if you're encrypting it and storing it on an isolated server with the decryption keys on a separate server, it's not a huge deal. Look, people on HN make a massive deal about passwords. One of my most shocking discoveries starting as a pentester was that "storing passwords in plaintext" would be a low-severity finding at best . Medium…

But what's the point of even bothering to encrypt a plaintext password at all, let alone "storing it on an isolated server with the decryption keys on a separate server" unless there's an automated way for a human to see the plaintext?

Re: 300M Freely Downloadable Pwned Passwords

#125

Post by jwives »

oelmekki wrote: post #110
lorenzk wrote: post #104

Earlier quoted context omitted.

Why pipe to md5sum?

I could just pass an option to make pwgen generate longer passwords, really, but I find amusing the idea of generating the hash of 160 urandom level generated passwords :) Now that's random! Oh, and also, it looks like a hashed password, so special troll points if a cracker find the password and think it's its hash. (note for people who may not know pwgen : it outputs 20 lines of 8 random passwords)

md5sum is going to limit your generated passwords to 128-bits because you're limited to 32 hexadecimal digits, which are each represented by 4 bits. [a-z][A-Z][0-9] can be represented by ~6 bits, so 32 characters would allow for 190 bits of entropy.

Re: 300M Freely Downloadable Pwned Passwords

#126

Post by Franciscouzo »

oelmekki wrote: post #91

I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…

Just use pwgen 32 instead

Re: 300M Freely Downloadable Pwned Passwords

#127

Post by Deimorz »

developer2 wrote: post #10
captn3m0 wrote: post #2

Going to generate a bloom-filter from this dataset tonight. Troy mentions some arguments against torrents, but it is better to have a authoritative torrent than none, imo.

Is a bloom filter worth it in this case? With the optimal "k" hash functions of 10 and a "p" error rate of 0.001% (false positives of approximately 1 in 1000), a bloom filter for the 306,259,512 items will take 538 MB. Increasing the error rate to 0.01% (1 in 100) is still 358 MB. That's a sizeable filter to maintain in memory (then again... RAM is cheap). I'd probably just shove the passwords into a database, limiti…

Reducing the size by ~95% in exchange for a 0.001% error rate seems like a pretty nice tradeoff to be able to make for some uses.

The nature of the data means it can never really be "perfect" anyway (there are certainly some password breaches that exist but aren't included in the list), so massively reducing the resources required in exchange for a bit of artificial error seems pretty reasonable to me.

Re: 300M Freely Downloadable Pwned Passwords

#129

Post by forgotAgain »

sleepybrett wrote: post #98
loginx wrote: post #80

Earlier quoted context omitted.

You think that's bad? My damn BANK has the following password policy for online banking: The password you create here can be used to access Online, Mobile and Telephone Banking. All passwords must be six characters in length. Special characters (eg. *, %, $, etc) will not be accepted.

get a new bank, then tell them why.

Send it in a certified letter. Address it to the CEO and send certified CC's to the FDIC, CIO, and a reporter for a local or national tech newspaper column.

It may sound archaic but you have to raise the visibility if you're concerned about changing the banks behavior.

Re: 300M Freely Downloadable Pwned Passwords

#130

Post by [deleted] »

oelmekki wrote: post #91

I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…

[deleted]
Post reply on HN