I'm enjoying typing in things that I've never used as passwords (my own name, for example) to see if anyone else at some point thought these things would make for good passwords.
300M Freely Downloadable Pwned Passwords
131–140 of 184 posts
Re: 300M Freely Downloadable Pwned Passwords
#132Earlier quoted context omitted.
I could just pass an option to make pwgen generate longer passwords, really, but I find amusing the idea of generating the hash of 160 urandom level generated passwords :) Now that's random! Oh, and also, it looks like a hashed password, so special troll points if a cracker find the password and think it's its hash. (note for people who may not know pwgen : it outputs 20 lines of 8 random passwords)
> (note for people who may not know pwgen : it outputs 20 lines of 8 random passwords) Unfortunately, it only does this if STDOUT is a TTY. If it's a pipe, then it outputs a single 8 character long password. So I'm afraid you've been generating rather low entropy passwords by piping the output of pwgen through md5sum. You can confirm this by piping pwgen through cat: pwgen | cat
i simultaneously love and loathe programs that do this, I long for some kind of shell pipe negotiation.
Most annoying trying to use "watch" or "less" and have the color work. "watch --color juju status --color", ahh. :-)
Re: 300M Freely Downloadable Pwned Passwords
#133Earlier quoted context omitted.
If you're on Windows, you can calculate it in PowerShell like this: $password = "foobar" ([Security.Cryptography.SHA1CryptoServiceProvider]::Create().ComputeHash([Text.Encoding]::ASCII.GetBytes($password)) | %{'{0:x2}' -f $_}) -join ""
And people say that PowerShell isn't readable or intuitive.
You can also do it like this:
"foobar" | Out-File password.txt -Encoding ASCII -NoNewline
Get-FileHash password.txt -Algorithm SHA1
del password.txt
Re: 300M Freely Downloadable Pwned Passwords
#134Earlier quoted context omitted.
> (note for people who may not know pwgen : it outputs 20 lines of 8 random passwords) Unfortunately, it only does this if STDOUT is a TTY. If it's a pipe, then it outputs a single 8 character long password. So I'm afraid you've been generating rather low entropy passwords by piping the output of pwgen through md5sum. You can confirm this by piping pwgen through cat: pwgen | cat
i simultaneously love and loathe programs that do this, I long for some kind of shell pipe negotiation. Most annoying trying to use "watch" or "less" and have the color work. "watch --color juju status --color", ahh. :-)
Having used isatty in some of my CLI programs to alter the behavior depending on whether STDOUT is a TTY, I see the appeal. It allows the program to do the best thing depending on how it's being invoked.
However, more recently I've grown skeptical. It leads to surprises, and if a person isn't familiar with the finer details of file descriptors, they may wonder why piping a program changes its behavior. I think this example of someone shooting himself in the foot with pwgen has convinced me never to do this again.
Re: 300M Freely Downloadable Pwned Passwords
#135Someone should apply deep learning to this and check how it compares with brute-forcing passwords. E.g. https://github.com/thoppe/5baa61e4c9b93f3f0682250b6cf8331b7e...
That's the point here. We know 300M passwords leaked, but we can't investigate these passwords and learn from this data. It's sad that researchers should look into black market if they want to get plain passwords. I'm pretty sure everyone who needs these passwords can find them.
Re: 300M Freely Downloadable Pwned Passwords
#136I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?
Someone made an Chrome extension to enable password pasting again. Don't Fuck With Paste: https://chrome.google.com/webstore/detail/dont-fuck-with-pas...
Thanks... :-) I hate that... I mean, pwd managers and paste are more secure than having to type them in.. not to mention, less prone to mistakes.
Re: 300M Freely Downloadable Pwned Passwords
#137>If a password is not found in the Pwned Passwords set, it'll result in a response like this: Wait, so I test my password to see if it's "good" and now you have a copy of a password I will be using. Am I just being paranoid?
You can post the sha1sum instead. $ sha1sum SooperSekretPassw0rd^D SooperSekretPassw0rddc0d3504b259a92dce59b850969601d12c06a75f -
sha1sum is giving different results.
/tmp$ echo "p@55w0rd" | sha1sum
8633c4a8b38a8826132414d8861af7b6a8371976 -
The python sha-1 hexdigest comes out right, though:
In [13]: import sha
In [14]: sha.new('p@55w0rd').hexdigest()
Out[14]: 'ce0b2b771f7d468c0141918daea704e0e5ad45db'
Re: 300M Freely Downloadable Pwned Passwords
#138Earlier quoted context omitted.
Well for that you can probably turn off JavaScript or use the web inspector to enable paste.
I can. My wife, who I've taught to use a password manager, probably can't. And neither of these excuses a 27 character limit that strongly suggests my password is being stored unencrypted somewhere.
use X windows - middle-click-to-paste usually gets around these 'no paste here' thingies. :)
Re: 300M Freely Downloadable Pwned Passwords
#139Earlier quoted context omitted.
Yes it totally is true. Hashes are a standard length, and you can feed any length passphrase into the hash algorithm. It wouldn't surprise me to see passphrases limited to e.g. 256 chars anyway, but 27 smells very bad. What system limitation leads to this particular number? It smells like a DB column width to me.
Password hashes are specifically designed to be computationally intensive. You can feed any length of password into a hash, but the longer the password is, the more work you have to do. "No length restriction on passwords" is a common and valid report on HackerOne, because servers that do store passwords securely can be DoSed by someone providing a long password and forcing the server to hash it.
Which is why you add a randomized wait/sleep before responding to an invalid login attempt, to, hopefully slow down "tries" having a cache for recent tries by IP as well would assist in mitigation. The strength of the hashing is also of issue... for example pbkdf2 is very compute heavy.
If you're working in an environment that has a FaaS (AWS Lambda, etc), it may be worthwhile to have this as an async function call so as not to block your primary application. Another option is to break authentication into its' own application, and have that return a signed auth token to your application.
There are lots of options.
Re: 300M Freely Downloadable Pwned Passwords
#140Earlier quoted context omitted.
I could just pass an option to make pwgen generate longer passwords, really, but I find amusing the idea of generating the hash of 160 urandom level generated passwords :) Now that's random! Oh, and also, it looks like a hashed password, so special troll points if a cracker find the password and think it's its hash. (note for people who may not know pwgen : it outputs 20 lines of 8 random passwords)
> (note for people who may not know pwgen : it outputs 20 lines of 8 random passwords) Unfortunately, it only does this if STDOUT is a TTY. If it's a pipe, then it outputs a single 8 character long password. So I'm afraid you've been generating rather low entropy passwords by piping the output of pwgen through md5sum. You can confirm this by piping pwgen through cat: pwgen | cat
Oh, you're right. Thanks for pointing that. Damn, that was an unexpected behavior (although, I can understand how it's helpful, when you want to get a password from a script/program that executes pwgen - but then I guess an option would have been enough).