[deleted]
"Pwned Passwords" V2 With Half a Billion Passwords
71–80 of 369 posts
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#72I'm going to have to disagree with the premise that sites should stop users from choosing a password which happens to have been cracked offline at some point in the past -- to the tune of blacklisting half a billion potential secrets. What exactly is the end goal, and at what cost? Well, there are 3 ways to steal a password. You can steal it from the user -- either by phishing or with malware -- in which case it matt…
> I'm going to have to disagree with the premise that sites should stop users from choosing a password which happens to have been cracked offline at some point in the past
Well, NIST, NCSC and Microsoft all seem to be on the same page:
https://www.ncsc.gov.uk/guidance/password-guidance-simplifyi...
https://pages.nist.gov/800-63-3/sp800-63b.html#5111-memorize...
https://www.microsoft.com/en-us/research/wp-content/uploads/...
> What exactly is the end goal
The end goal is to prevent password spraying attacks. If the attacker can get in on the first try because the user has re-used credentials in between two services, account lockout policies don't help and neither does BlindHash (if the compromised service wasn't using it). For it to bring any significant security benefit you would need everyone to use it (which will obviously never happen).
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#73Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…
I've used Lastpass for awhile, and so does my work. Recently I switched to Bitwarden partly because of security concerns, partly because it's open source, but mostly due to Firefox moving to WebExtensions. They both have free options!
How recently? Because https://addons.mozilla.org/en-US/firefox/addon/lastpass-pass... shows "Compatible with Firefox 57+" since early November.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#74Re: "Pwned Passwords" V2 With Half a Billion Passwords
#75A quick Ruby script to check if a password has been compromised using the Pwned Passwords V2 API: https://gist.github.com/schmich/aeaffac922271a11b70e9a79a5fe...
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#76Hmm this is a pretty great list to use for any service that has user signups -- disallow signup when using a password that is known to have been "pwned"! :)
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#77Oh the shame! An important password of mine is pwned. Just had to change it.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#78Can someone please just provide the exact shell commands to generate a compatible sha-1 of a password to grep against the database? The article seems to ramble forever about how to perform online checks without discussing the basic offline secure option.
echo -n "password" | openssl sha1 | tr '[:lower:]' '[:upper:]'
On my machine this produces
(STDIN)= 5BAA61E4C9B93F3F0682250B6CF8331B7EE68FD8
echo -n "$password" | openssl sha1 -binary | xxd -p -uRe: "Pwned Passwords" V2 With Half a Billion Passwords
#79I just tried a 11 character password without special chars, that I’ve used on over 50 sites, over the last decade. It’s my password for throaway websites. Some pretty dodgy.
Not in the database.
Makes me feel pretty good about password security overall!
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#80An old password (12 char numbers and letters) I've since stopped using (but used to use everywhere) appears as pwned in this list (3 times!). I'd love to know who exposed it. Any chance I can find out?
You could check for your email on https://haveibeenpwned.com/