Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

300M Freely Downloadable Pwned Passwords

troyhunt.com

Post reply on HN
Print view View original

171–180 of 184 posts

Re: 300M Freely Downloadable Pwned Passwords

#171

Post by ShinTakuya »

oelmekki wrote: post #91

I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…

Or, you know, you can just use a password manager. Using forgot password all over the place is a bad idea, a lot of sites send you a temporary password that people can find in your emails if they ever hack your emails.

Pick a really good password for your password manager and remember that. Doesn't matter too much which password manager. If you're paranoid use KeePass, otherwise I personally use LastPass.

Re: 300M Freely Downloadable Pwned Passwords

#172

Post by oelmekki »

ShinTakuya wrote: post #171
oelmekki wrote: post #91

I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…

Or, you know, you can just use a password manager. Using forgot password all over the place is a bad idea, a lot of sites send you a temporary password that people can find in your emails if they ever hack your emails. Pick a really good password for your password manager and remember that. Doesn't matter too much which password manager. If you're paranoid use KeePass, otherwise I personally use LastPass.

If someone access my mailbox, they'll use lost password to access other websites :)

Re: 300M Freely Downloadable Pwned Passwords

#173

Post by zild3d »

forgotAgain wrote: post #129
sleepybrett wrote: post #98

Earlier quoted context omitted.

get a new bank, then tell them why.

Send it in a certified letter. Address it to the CEO and send certified CC's to the FDIC, CIO, and a reporter for a local or national tech newspaper column. It may sound archaic but you have to raise the visibility if you're concerned about changing the banks behavior.

People just tweet @ceo or @company these days, same effect

Re: 300M Freely Downloadable Pwned Passwords

#174

Post by CodesInChaos »

thaumasiotes wrote: post #167
bigiain wrote: post #153

Earlier quoted context omitted.

NIST's latest recommendations say "at least 64 characters". I doubt there's anyone who can make a strong argument that "64 characters isn't enough", and I doubt even intentionally computationally expensive password hashing is going to end up with significant resource usage with 64 or 128 character strings. I wouldn't want my shared hosting WordPress site with a password plugin to need to calculate the bcrypt hash of…

I usually see recommendations for a 72 character limit. I doubt there's any particular reason for 72, but as you say, it's enough. Login attempts (should) get rate limited independently of password length limits, which makes the difference between hashing 8 characters and hashing 72 characters even less meaningful.

I'd guess it's because bcrypt only supports 72-byte inputs (though there are workarounds, like pre-hashing)

Re: 300M Freely Downloadable Pwned Passwords

#175

Post by duxup »

mohn wrote: post #116
duxup wrote: post #66

Earlier quoted context omitted.

I find that on some sites if I click in the username field and alt tab to keepass or any other function I'm suddenly not in the txt field on the site... thus I can't trigger auto type at times.

It's unfortunate that this workaround is needed, but in KeePass you can set a custom keystroke sequence to define what actions are performed during auto-type. Right click > "Edit/view entry" > "Auto-Type" tab > Override default sequence: I then entered {DELAY 3000}{PASSWORD} Now I can log in to a full screen game that doesn't allow pasting (I type in the username by hand first). If I'm alt-tabbed out of the game with…

Thank you!

Re: 300M Freely Downloadable Pwned Passwords

#176

Post by rrauenza »

AlexCoventry wrote: post #137
rrauenza wrote: post #96

Earlier quoted context omitted.

You can post the sha1sum instead. $ sha1sum SooperSekretPassw0rd^D SooperSekretPassw0rddc0d3504b259a92dce59b850969601d12c06a75f -

sha1sum is giving different results. /tmp$ echo "p@55w0rd" | sha1sum 8633c4a8b38a8826132414d8861af7b6a8371976 - This is a different value from the one given in the blog post: "ce0b2b771f7d468c0141918daea704e0e5ad45db". The python sha-1 hexdigest comes out right, though: In [13]: import sha In [14]: sha.new('p@55w0rd').hexdigest() Out[14]: 'ce0b2b771f7d468c0141918daea704e0e5ad45db' In case anyone else has passwords th…

Make sure you clean your .history if you're using echo to pipe the password...

Re: 300M Freely Downloadable Pwned Passwords

#177

Post by royce »

Deimorz wrote: post #117

One really unfortunate aspect of the passwords being hashed is that there's no info available about their lengths. Knowing the lengths could allow you to reduce the size considerably when you enforce a minimum password length. For example, if I have a site that requires passwords to be at least 10 chars long, I don't need any of the data for breached passwords that are shorter than 10 characters. People can't possibl…

I've cracked* just under 99% of them so far (including the 14 million added in Update 1). Statistics are here:

https://gist.github.com/roycewilliams/b1de2afbfe5cb71bea16c9...

Regardless of composition, the top 12 lengths are:

    8: 32% (102260862)
   10: 14% (45084047)
    9: 13% (41525797)
    7: 10% (33632055)
    6: 06% (20211176)
   11: 05% (18275968)
   12: 04% (14052958)
   15: 02% (8291459)
   13: 02% (8042452)
   14: 01% (6321198)
   16: 01% (4201765)
    5: 00% (3054291)
In other words, requiring a minimum length of 12 would make 80% of the passwords in the corpus inapplicable.

... and the top 12 masks are:

  ?l?l?l?l?l?l?l?l,47823614
  ?l?l?l?l?l?l?d?d,7005728
  ?d?d?d?d?d?d?d?d,6212778
  ?l?l?l?l?l?l?l?l?l?l,6023602
  ?l?l?l?l?l?l?l?l?l,5379482
  ?l?l?l?l?l?l?l?d?d,5169013
  ?l?l?l?l?l?l?l?l?d?d,5090400
  ?l?l?l?l?l?l?l,4998896
  ?d?d?d?d?d?d?d,4798329
  ?l?l?l?l?d?d?d?d,4798124
  ?d?d?d?d?d?d?d?d?d?d,4754401
  ?l?l?l?l?l?l?d?d?d?d,4377841
Almost 48 million of them are 8 lower-case characters.

* And to be clear, "cracked" is an overstatement. Many of his sources are public. Simply using those sources as wordlists makes "cracking" these like shooting fish in a barrel.

Re: 300M Freely Downloadable Pwned Passwords

#178

Post by [deleted] »

royce wrote: post #177
Deimorz wrote: post #117

One really unfortunate aspect of the passwords being hashed is that there's no info available about their lengths. Knowing the lengths could allow you to reduce the size considerably when you enforce a minimum password length. For example, if I have a site that requires passwords to be at least 10 chars long, I don't need any of the data for breached passwords that are shorter than 10 characters. People can't possibl…

I've cracked* just under 99% of them so far (including the 14 million added in Update 1). Statistics are here: https://gist.github.com/roycewilliams/b1de2afbfe5cb71bea16c9... Regardless of composition, the top 12 lengths are: 8: 32% (102260862) 10: 14% (45084047) 9: 13% (41525797) 7: 10% (33632055) 6: 06% (20211176) 11: 05% (18275968) 12: 04% (14052958) 15: 02% (8291459) 13: 02% (8042452) 14: 01% (6321198) 16: 01% (4…

[deleted]

Re: 300M Freely Downloadable Pwned Passwords

#179

Post by dredmorbius »

oelmekki wrote: post #91

I really would love we be done with passwords altogether. We're asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they're dumb if they didn't do that. Currently, my way to generate a new password is this : `pwgen | md5sum`. And t…

So long as you're hashing the output, go straight to the source. And if you're going to hash, use a longer hash.

    dd if=/dev/urandom bs=2048 count=1 | od -A none -l |
        sha512sum
Or just generate a long password:

    pwgen 2048 1

Re: 300M Freely Downloadable Pwned Passwords

#180

Post by dredmorbius »

cobookman wrote: post #81
devy wrote: post #58

Can Troy or someone contact Google (bq-public-data@google.com) and push this to the GCP's BigQuery public dataset[1] for hosting and easier look up your password via SQL in BigQuery rather than some 3rd party site? [1] https://cloud.google.com/bigquery/public-data/

I work for Google cloud. Will ping internally about us hosting it.

Thank you.
Post reply on HN