Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

Post reply on HN
Print view View original

41–50 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#41

Post by ChrisSD »

Lxr wrote: post #38
groovecoder wrote: post #19

do not skip the section on "Cloudflare, Privacy and k-Anonymity" ... it is a great summary of an elegant privacy solution. And check out Cloudflare's detail post too: https://blog.cloudflare.com/validating-leaked-passwords-with...

Can you clarify what problem this solves?

As stated in the post, it's a simple solution to help with anonymity.

"The password has been hashed client side and just the first 5 characters passed to the API As mentioned earlier, there are 475 hashes beginning with "21BD1", but only 1 which matches the remainder of the hash for "P@ssw0rd" and that record indicates that the password has previously been seen 47,205 times."

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#42

Post by recursive »

ChrisSD wrote: post #35
blibble wrote: post #21

Earlier quoted context omitted.

personally I've always just done: and picked a bit I liked

Picking the bit you like makes it hard to reason about how secure that is. It could be your preferences are much narrower than you realise. If you're going for something you find aesthetically pleasing or memorable then that's probably going to seriously limit password entropy. On the other hand if you're trying to pick something that "looks random" then you should know humans are terrible at that.

20 perfectly random characters from a base64 stream have 20*6 = 120 bits of entropy. If you pick 20 characters from out of 1000 choices you can see on the screen, that would seem to remove at most 10 bits of entropy, no? (2^10 ~~ 1000)

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#43

Post by 667 »

JoshTriplett wrote: post #9
roymurdock wrote: post #3

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

The Firefox password manager, combined with Firefox Sync, works across Windows, Mac, Linux, iOS, and Android.

Been using this a few years, it's really good from user standpoint.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#44

Post by fhenneke »

jkaptur wrote: post #33
groovecoder wrote: post #19

do not skip the section on "Cloudflare, Privacy and k-Anonymity" ... it is a great summary of an elegant privacy solution. And check out Cloudflare's detail post too: https://blog.cloudflare.com/validating-leaked-passwords-with...

I'm a bit confused - why not distribute a serialized Bloom filter representing these passwords? That would seem to enable a compact representation (low Azure bill) and client-side querying (maximally preserving privacy).

A Bloom filter with >500M items, even when allowing for a comparatively high rate of false positives such as 1 in 100, is still in the hundreds of MBs, which would not be that much more accessible than the actual dump files.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#45

Post by qznc »

roymurdock wrote: post #3

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

I'm a heavy KeePass user in private and I like it. Recently, I was pleasently surprised that my new corporate IT overlords allow me to use it at work too.

Password generation is fine. Whenever you create a new entry it prepopulates it with a generated password. Just type in domain and username and hit ok.

On the negative side, KeePass UI is old school. Lots of buttons and options. Not streamlined for the common use cases.

(No comment on download and setup, since I'm not a Windows user)

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#47

Post by PuffinBlue »

SteveJS wrote: post #31
roymurdock wrote: post #3

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

I was looking at Dashlane which seemed to have some good features, including some ability to do password rotation automatically, and some level of yubikey support. That said I'm still using keepass. I discovered it when I needed a solution that worked on an original Surface RT, as well as an iphone, and I've remained happy.

Now Dashlane seems to have in browser apps and finally supports Linux, I'm looking at moving away from Lastpass.

Between them and BitWarden there seems to be quite good options form Linux users now.

If anyone is a DashLane/BitWarden user and wants to chime in with their experience them that would be much appreciated.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#48

Post by ChrisSD »

blibble wrote: post #40
ChrisSD wrote: post #35

Earlier quoted context omitted.

Picking the bit you like makes it hard to reason about how secure that is. It could be your preferences are much narrower than you realise. If you're going for something you find aesthetically pleasing or memorable then that's probably going to seriously limit password entropy. On the other hand if you're trying to pick something that "looks random" then you should know humans are terrible at that.

"picked a bit I liked" means selecting a length suitable for the site without any weird characters that the site will reject, not trying to find my place of birth in the output!

Ah ok, that makes more sense! I'm just so use to people telling me they "like" their password to be the name of their cat. :P

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#49

Post by benbristow »

orasis wrote: post #46

Can someone please just provide the exact shell commands to generate a compatible sha-1 of a password to grep against the database? The article seems to ramble forever about how to perform online checks without discussing the basic offline secure option.

http://onlinemd5.com/

Just uses JavaScript in the browser

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#50

Post by __jal »

chrislomax wrote: post #16
roymurdock wrote: post #3

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

Again, 1Password. It allows you to login to multiple workspaces so you can have your family plan and your work team plan at the same time. There is a cost but I can guarantee that it’s saved me more in time than the cost could ever amount to. I’ve never used an insecure password since using it. All completely random and it’s so easy to use. The different vaults means I can grant my little boy access to the stuff he u…

I love 1Password and have used it for years.

But be aware that they are moving to cloud storage for password data. At this point, you're not forced in to it (and they've made no concrete announcement yet), but that's pretty clearly where they want to go.

Perhaps that's acceptable to you; I'll be moving off at that point. But in any case, it is something to be aware of when choosing something like this - moving between password managers is a hassle.

Post reply on HN