Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

21–30 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#21

On the topic of passwords, have a look at my command-line passphrase generation program. GitHub: https://github.com/ctsrc/pgen It's written in Rust. Install the Rust toolchain installer from https://rustup.rs/ curl https://sh.rustup.rs -sSf | sh And remember to add ~/.cargo/bin to your PATH. Then install my command-line utility cargo install pgen Usage is described in detail in the README on GitHub. Additionally you…

personally I've always just done:

    
and picked a bit I liked

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#22
post #14

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

I don't trust myself enough to keep track of a local database of passwords, because of that for years I sticked to the tactic of repeating the same 2~3 passwords over and over on all websites. Now I'm using https://lesspass.com/ , a deterministic password generator that requires no setup besides installing a browser extension[1] and doesn't requires me to keep a database or run any other custom programs. [1]: There's…

How does lesspass handle password rules?

i.e. one site allows special characters, others don't?

Or say one of your passwords gets compromised and you need to change it.

It doesn't seem like lesspass would be able to do so without a db.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#23

On the topic of passwords, have a look at my command-line passphrase generation program. GitHub: https://github.com/ctsrc/pgen It's written in Rust. Install the Rust toolchain installer from https://rustup.rs/ curl https://sh.rustup.rs -sSf | sh And remember to add ~/.cargo/bin to your PATH. Then install my command-line utility cargo install pgen Usage is described in detail in the README on GitHub. Additionally you…

A personal question. Do people really install megabytes of dependencies to run what would be a one line shell script, were it written in shell?

You wouldn't manage that with a one-line shell script, assuming that you want to format it reasonably. :)

I do agree that having to install loads of things for a simple tool is overkill, but I'd wager the actual binary produced doesn't have many dependencies (I'd expect just libc, in fact); so would this at some point land in a package manager, your life will improve.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#24

On the topic of passwords, have a look at my command-line passphrase generation program. GitHub: https://github.com/ctsrc/pgen It's written in Rust. Install the Rust toolchain installer from https://rustup.rs/ curl https://sh.rustup.rs -sSf | sh And remember to add ~/.cargo/bin to your PATH. Then install my command-line utility cargo install pgen Usage is described in detail in the README on GitHub. Additionally you…

FWIW, 'cargo install' is designed to be for distributing dev-tools, rather than for end-user tools. I believe https://github.com/japaric/trust is designed to make it very easy to publish Github Releases from CI systems.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#25

On the topic of passwords, have a look at my command-line passphrase generation program. GitHub: https://github.com/ctsrc/pgen It's written in Rust. Install the Rust toolchain installer from https://rustup.rs/ curl https://sh.rustup.rs -sSf | sh And remember to add ~/.cargo/bin to your PATH. Then install my command-line utility cargo install pgen Usage is described in detail in the README on GitHub. Additionally you…

A personal question. Do people really install megabytes of dependencies to run what would be a one line shell script, were it written in shell?

A bigger issue is blindly executing "curl ... | sh -" for something you are going to use to generate passwords (though it's bad in general).

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#26

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

I've tried to get my mom to use KeePass with limited success. To her having her easily guessable passwords written in a little notebook next to the computer is fine.

I think a prerequisite is getting buy in on the idea that passwords need to be treated like the keys to your house or your bank account numbers.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#27
[Pasting an old comment of mine on password managers, since I see people talking about starting to use Keepass. I hope this helps someone]

----

If you're just starting, here's some guidance on setting up a password manager.

First of all: Don't be afraid of using one. It's not just more secure, it's super convenient. Never again will you ask yourself: Did I make an account for this website/service? What email did I use? Never again will you have to remember a password. Using a password manager is a quality of life improvement.

KeepassXC is what I recommend to people at this point. It's free and you own your data (your passwords). They live wherever you want them to live. There are plenty of online services that are supposedly more convenient but I have to say I trust them less -- YMMV (1Password is the best I'm aware of).

https://keepassxc.org

If you do use keepassxc, you get the added benefit of being able to store 2FA settings in it as well (if you store them in the same database as your passwords, be aware that you lose the security benefit of a second factor, however it is still more secure than not having 2FA enabled due to the One-time password component).

Put every account you ever made and ever make into keepass. Enable 2fa wherever you don't have it enabled. Add login URLs and notes. Generate your passwords from keepass itself; the password generator is really powerful and lets you very easily deal with site-specific shitty password limitations. I'm telling you this because, seriously, it's incredibly convenient to have this stuff as long as you're rigorous about maintaining it.

Oh, also, keepass has the full history of all your passwords. Need to look up an old password? Go into details and look at "History". You can also attach files to items (items don't have to be accounts at all, you can use keepassxc as a simple encrypted storage db).

Mobile support: Keepass2Android. Best android client, with google drive support. iOS I have no idea, suggestions welcome.

IMPORTANT: BE STUPIDLY PARANOID AND RIGOROUSLY CAREFUL ABOUT YOUR MASTER PASSWORD. That thing, together with your keepass database, unlocks all your accounts ever. Use a really long passphrase that you will never have to write down (if you do decide to write it down because you don't trust yourself, store it in a safety deposit box, don't put it in a bloody drawer). Make sure the device you unlock the database on is malware-free.

PS: Wondering what's up with Keepass vs. KeepassX vs. KeepassXC? Keepass is the original app, written in .NET but with poor multi-platform support. KeepassX is a rewrite in Qt and is a fantastic password manager, but has gone unmaintained recently. The open source community picked up the slack in the KeepassXC fork (after continuing countless attempts to upstream the patches) and has implemented lots of powerful features. I've switched to it and at this point I strongly believe it's the better client.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#28
post #13

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

Actually, I’m pretty happy with the integrated iOS password manager. They also feature app support now. Works like a charm for me

Happily, too, Safari’s suggested passwords have pretty good entropy and are sensible enough to be accepted by many password rulesets.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#29

Earlier quoted context omitted.

A personal question. Do people really install megabytes of dependencies to run what would be a one line shell script, were it written in shell?

A bigger issue is blindly executing "curl ... | sh -" for something you are going to use to generate passwords (though it's bad in general).

[deleted]

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#30
post #17
post #7

Earlier quoted context omitted.

Long time lastpass user recently switched to BitWarden. I find it's UI to be cleaner/easier to use

My biggest frustration with lastpass is that it doesn't seem to know the difference between subdomains, so it suggests several passwords for the same domain even though I am on different subdomains.

There was an option somewhere with which you could disable that one url at a time. I never bothered with it though and recently switched to keepass, so can't verify anymore.
Post reply on HN