I'm confused. If a website salted their hashes, wouldn't it not matter if he password alone was "pwned"?
300M Freely Downloadable Pwned Passwords
161–170 of 184 posts
Re: 300M Freely Downloadable Pwned Passwords
#162I'm confused. If a website salted their hashes, wouldn't it not matter if he password alone was "pwned"?
If a website salts their hashes, that only helps protect their users if that website is hacked and their password database stolen.
But 306 million passwords have already been exposed by data breaches at other sites. And users have a tendency to reuse passwords across multiple sites. Just because your website wasn't hacked doesn't mean an attacker can't go look up one of your users in someone else's data breach and try the same password on your site.
Re: 300M Freely Downloadable Pwned Passwords
#163I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field. Who do we lobby to get them to fail their next PCI-DSS compliance test?
Someone made an Chrome extension to enable password pasting again. Don't Fuck With Paste: https://chrome.google.com/webstore/detail/dont-fuck-with-pas...
I've used this extension before, just a note that it will break legitimate onpaste events, for example websites that let you paste an image in, like Imgur or Twitter
Re: 300M Freely Downloadable Pwned Passwords
#164I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…
Problems: 1) email is insecure, 2) it requires two logins, 3) it's not dual factor, 4) it's more error-prone. It's less work [and more secure] to just implement Google or Facebook authentication.
In terms of generating a strong password: most browsers have password generators (which I didn't even know about until recently). They aren't all enabled by default and they don't work on all forms, and not all browsers have them. Browsers also have supported user certificates [which are more secure than passwords, sort of] for like 15 years, but nobody ever uses them. The main reason (afaik) is how shit the browser's UX for them was, in combination with a burden of complexity - and of course you can't use them on random public devices.
I think we are close to reaching an authentication nirvana. If U2F came embedded in all new computing devices, and an open method of securely synchronizing all devices and service providers was used, we could effectively skip passwords, and rely almost entirely on backup codes for the few times they were needed. A lot of laptops and phones come with fingerprint scanners now. If those scanners were used as part of a U2F solution we would have a pretty solid authentication mechanism. (fingerprints are not foolproof, but IMHO they are about as secure as a password)
Re: 300M Freely Downloadable Pwned Passwords
#165I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…
chrome already does that (but i still stick with keepass)
Re: 300M Freely Downloadable Pwned Passwords
#166Earlier quoted context omitted.
Email address is stupid, we should have randomly generated proxy email addresses.
A former coworker makes liberal use of American Express disposable credit card numbers -- proxy credit card numbers that you can request to give away to less than trustworthy merchants.
My Citibank card has the same feature, although the number generation applet requires Flash.
On a banking website.
In mid-2017.
Re: 300M Freely Downloadable Pwned Passwords
#167Earlier quoted context omitted.
That is an important consideration, but it still sets reasonable password length limits in the hundreds or thousands of characters.
NIST's latest recommendations say "at least 64 characters". I doubt there's anyone who can make a strong argument that "64 characters isn't enough", and I doubt even intentionally computationally expensive password hashing is going to end up with significant resource usage with 64 or 128 character strings. I wouldn't want my shared hosting WordPress site with a password plugin to need to calculate the bcrypt hash of…
I usually see recommendations for a 72 character limit. I doubt there's any particular reason for 72, but as you say, it's enough.
Login attempts (should) get rate limited independently of password length limits, which makes the difference between hashing 8 characters and hashing 72 characters even less meaningful.
Re: 300M Freely Downloadable Pwned Passwords
#168I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…
Email address is stupid, we should have randomly generated proxy email addresses.
Email addresses have been working fine for me. What I would love though is a way to easily alias my phone number.
Re: 300M Freely Downloadable Pwned Passwords
#169Earlier quoted context omitted.
A former coworker makes liberal use of American Express disposable credit card numbers -- proxy credit card numbers that you can request to give away to less than trustworthy merchants.
Privacy ( https://privacy.com/ ) offers a similar service for those that want something that works with more than American Express cards or other such offerings from other card issuers.
Did not know about this! Checked it out, got really excited... and then discovered it's US only :-(
Re: 300M Freely Downloadable Pwned Passwords
#170I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…
I personally use KeePass, I generate 20+ character random passwords and it save them in a encrypted file. I just wrote my email password and hide it in case I lose my file.
I also use KeePass to generate long, pseudo-random passwords. The amount of different passwords I need is far beyond what I can hold in my head, especially when they have to be secure. I got my closest family to use KeePass too, which lead to a significant reduction in lost passwords and hacked accounts.