Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

Post reply on HN
Print view View original

81–90 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#81

Post by __jal »

angerbot wrote: post #68
__jal wrote: post #50

Earlier quoted context omitted.

I love 1Password and have used it for years. But be aware that they are moving to cloud storage for password data. At this point, you're not forced in to it (and they've made no concrete announcement yet), but that's pretty clearly where they want to go. Perhaps that's acceptable to you; I'll be moving off at that point. But in any case, it is something to be aware of when choosing something like this - moving betwee…

Have you read their security white paper[1]? As much as I tend to freak out about cloud storage of password data (one reason I moved off of lastpass), they do seem to take fairly strong steps to host-proof the data (such as having an on-device generated secret key that they never receive). [1]: https://1password.com/files/1Password%20for%20Teams%20White%...

I did read it. For me, it doesn't matter for two reasons. Professionally, I have a policy to comply with. And personally, I don't use other peoples' machines for personal storage, period. So why would I want my (even well protected, assuming 1PW didn't make a mistake) passwords to be an exception?

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#82

Post by zyxzkz »

noja wrote: post #74
georgyo wrote: post #57

Earlier quoted context omitted.

echo -n "password" echo adds a new line that is likely not in your password.

No it doesn't: -n do not output the trailing newline

He's saying echo without an argument emits a newline, so use -n to suppress it.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#83

Post by jobigoud »

skykooler wrote: post #61
groovecoder wrote: post #19

do not skip the section on "Cloudflare, Privacy and k-Anonymity" ... it is a great summary of an elegant privacy solution. And check out Cloudflare's detail post too: https://blog.cloudflare.com/validating-leaked-passwords-with...

Why does 0000 have the largest number of hashes? Does SHA-1 not distribute hash values evenly?

It's indeed weird that "00000" would be the hash prefix with the highest number of entries. I think it must be a hidden variable. Like some sources put an all-zeroed-out hash in the database for testing or in case of a registration error or for deleted users, and these show up here.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#84

Post by bllguo »

BugsJustFindMe wrote: post #73
bllguo wrote: post #5

Earlier quoted context omitted.

I've used Lastpass for awhile, and so does my work. Recently I switched to Bitwarden partly because of security concerns, partly because it's open source, but mostly due to Firefox moving to WebExtensions. They both have free options!

How recently? Because https://addons.mozilla.org/en-US/firefox/addon/lastpass-pass... shows "Compatible with Firefox 57+" since early November.

There was no compatibility when I switched, and I waited for some time (I use Nightly). Maybe "recent" is misleading.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#85

Post by doublerebel »

PuffinBlue wrote: post #47
SteveJS wrote: post #31

Earlier quoted context omitted.

I was looking at Dashlane which seemed to have some good features, including some ability to do password rotation automatically, and some level of yubikey support. That said I'm still using keepass. I discovered it when I needed a solution that worked on an original Surface RT, as well as an iphone, and I've remained happy.

Now Dashlane seems to have in browser apps and finally supports Linux, I'm looking at moving away from Lastpass. Between them and BitWarden there seems to be quite good options form Linux users now. If anyone is a DashLane/BitWarden user and wants to chime in with their experience them that would be much appreciated.

I love Dashlane, and the Linux support is solid through the browser extension. Dashlane has the best interface across devices, of all the password managers I've used. The password sharing feature is great for business.

Sure, it's a cloud service, but it's polished enough that I can get non-tech people like my family and coworkers to actually use it. Lastpass did not pass that test.

I use Dashlane every day on Mac, Linux, Windows, and Android.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#86

Post by markdown »

groovecoder wrote: post #19

do not skip the section on "Cloudflare, Privacy and k-Anonymity" ... it is a great summary of an elegant privacy solution. And check out Cloudflare's detail post too: https://blog.cloudflare.com/validating-leaked-passwords-with...

A warning about Cloudflare:

You cannot access their support in any way without logging in. Trying to contact them via their contact/sales page won't work. They won't respond.

This means that if you lose your phone (2FA) and can't log in, you're royally screwed and will have to go to your registrar to recover access to your domains/DNS.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#87

Post by mseebach »

scrollaway wrote: post #27

[Pasting an old comment of mine on password managers, since I see people talking about starting to use Keepass. I hope this helps someone] ---- If you're just starting, here's some guidance on setting up a password manager. First of all: Don't be afraid of using one. It's not just more secure, it's super convenient. Never again will you ask yourself: Did I make an account for this website/service? What email did I us…

> you get the added benefit of being able to store 2FA settings

Don't do this. If you use a password manager with all the benefits this entails (long, random passwords, each only used for a single site), the only benefit 2FA really gives you is if your password manager is compromised somehow. If your second factor is in your password manager, you're screwed.

I use Authy with a long, secure password printed on a piece of paper. Yes, it is cloud and third party and everything, but it's on a completely orthogonal chain from my Keepass DB, so dual compromises are significantly more difficult.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#88

Post by squegles »

ianlevesque wrote: post #53
orasis wrote: post #46

Can someone please just provide the exact shell commands to generate a compatible sha-1 of a password to grep against the database? The article seems to ramble forever about how to perform online checks without discussing the basic offline secure option.

echo -n "password" | openssl sha1 | tr '[:lower:]' '[:upper:]'

This worked. Wow an old, old password that is fairly unique was seen 36 times.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#89

Post by Spooky23 »

angerbot wrote: post #68
__jal wrote: post #50

Earlier quoted context omitted.

I love 1Password and have used it for years. But be aware that they are moving to cloud storage for password data. At this point, you're not forced in to it (and they've made no concrete announcement yet), but that's pretty clearly where they want to go. Perhaps that's acceptable to you; I'll be moving off at that point. But in any case, it is something to be aware of when choosing something like this - moving betwee…

Have you read their security white paper[1]? As much as I tend to freak out about cloud storage of password data (one reason I moved off of lastpass), they do seem to take fairly strong steps to host-proof the data (such as having an on-device generated secret key that they never receive). [1]: https://1password.com/files/1Password%20for%20Teams%20White%...

From a legal perspective, once things enter the custody of a third party, your exclusive rights to that data are dramatically diminished.
Post reply on HN