Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

Post reply on HN
Print view View original

91–100 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#91

Post by Spooky23 »

sebazzz wrote: post #8
roymurdock wrote: post #3

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

Keepass works great, but one disadvantage is that you cannot you additional credentials providers if you want to open your database on other devices. For instance, if I would use a Yubikey provider, I cannot open the database on my iPhone. It would be great if the authentication providers can be configured in an 'or' instead of an 'AND' (this means convenience vs security). So on Windows, with my Windows account or p…

One way to address this is to have a long term vault that doesn’t get edited often and a working vault.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#92

Post by zaroth »

nextgens wrote: post #72
zaroth wrote: post #39

I'm going to have to disagree with the premise that sites should stop users from choosing a password which happens to have been cracked offline at some point in the past -- to the tune of blacklisting half a billion potential secrets. What exactly is the end goal, and at what cost? Well, there are 3 ways to steal a password. You can steal it from the user -- either by phishing or with malware -- in which case it matt…

> I'm going to have to disagree with the premise that sites should stop users from choosing a password which happens to have been cracked offline at some point in the past Well, NIST, NCSC and Microsoft all seem to be on the same page: https://www.ncsc.gov.uk/guidance/password-guidance-simplifyi... https://pages.nist.gov/800-63-3/sp800-63b.html#5111-memorize... https://www.microsoft.com/en-us/research/wp-content/uplo…

NIST has unfortunately been the source of a lot of bad advice which has actively harmed password security the last decade. (e.g. [1])

Cargo culting is generally a good thing in crypto because, you know, don’t roll your own. But in this case we’re talking about policy. And this policy is as user hostile (if not worse) than the prior NIST advice on password expiry.

If you want to stop password spraying, protect your hashes. There’s no proof that blacklisting half a billion specific secrets will make cracking any more difficult. Making it neigh impossible for users to register with your service, well I guess if you have no users you have no passwords to lose.

But the point is a blacklist this extensive is just as likely to make passwords easier to crack, not harder, and will come with a direct cost to the company implementing it. I understand well the goal, I’m entirely unconvinced this helps achieve it.

I would be interested to hear Gosney’s (cracker extraordinaire) and Cormac’s (Microsoft Research) take on this.

[1] - https://www.engadget.com/amp/2017/08/08/nist-new-password-gu...

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#93

Post by scrollaway »

mseebach wrote: post #87
scrollaway wrote: post #27

[Pasting an old comment of mine on password managers, since I see people talking about starting to use Keepass. I hope this helps someone] ---- If you're just starting, here's some guidance on setting up a password manager. First of all: Don't be afraid of using one. It's not just more secure, it's super convenient. Never again will you ask yourself: Did I make an account for this website/service? What email did I us…

> you get the added benefit of being able to store 2FA settings Don't do this. If you use a password manager with all the benefits this entails (long, random passwords, each only used for a single site), the only benefit 2FA really gives you is if your password manager is compromised somehow. If your second factor is in your password manager, you're screwed. I use Authy with a long, secure password printed on a piece…

> Don't do this.

On the other hand, do do this, but be aware of the tradeoffs.

I hate telling people not to do something. Most people just end up not turning 2FA on at all. My approach has converted many people from "one password reused everywhere, at best with variations" to KeepassXC unique passwords everywhere + 2FA and I classify that as a big win.

The biggest benefit of TOTP 2FA isn't the "second factor" part, it's the OTP part. This removes many forms of phishing, keylogging and database leaks as a threat to your account. You do not lose these benefits when you have it all in one factor.

If you read my comment, you'll see I address this concern. If this is a real threat for you, then you can always simply use a separate Keepass database for your OTP settings.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#94

Post by r1ch »

mnutt wrote: post #65
ianlevesque wrote: post #53

Earlier quoted context omitted.

echo -n "password" | openssl sha1 | tr '[:lower:]' '[:upper:]'

You may also want to consider running `unset HISTFILE` before that to ensure that the line containing your password doesn't end up sitting around in your bash history.

Another way is to prefix the command with whitespace.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#96

Post by cookiecaper »

ChrisSD wrote: post #35
blibble wrote: post #21

Earlier quoted context omitted.

personally I've always just done: and picked a bit I liked

Picking the bit you like makes it hard to reason about how secure that is. It could be your preferences are much narrower than you realise. If you're going for something you find aesthetically pleasing or memorable then that's probably going to seriously limit password entropy. On the other hand if you're trying to pick something that "looks random" then you should know humans are terrible at that.

I dunno, I wouldn't discount this entirely. An advanced targeted attack could likely profile a user for their "likes" in a random string (e.g., favorite letters appearing often), but in the case of anonymous, brute-force-style attacks, "I just click things and scroll around until I see something I like" is probably really useful. It could, for example, protect against a somewhat predictable generator, since you won't know "the user always uses the first password, and the first password is always seeded incorrectly", or some other specific implementation flaw.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#98

Post by mino »

groovecoder wrote: post #19

do not skip the section on "Cloudflare, Privacy and k-Anonymity" ... it is a great summary of an elegant privacy solution. And check out Cloudflare's detail post too: https://blog.cloudflare.com/validating-leaked-passwords-with...

Just added an extra line to the bash wrapper to print how many time the given password appears in the dump:

https://gist.github.com/mino98/8aa240fa55a8182198fba58fb810b...

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#99

Post by baliex »

r1ch wrote: post #94
mnutt wrote: post #65

Earlier quoted context omitted.

You may also want to consider running `unset HISTFILE` before that to ensure that the line containing your password doesn't end up sitting around in your bash history.

Another way is to prefix the command with whitespace.

Only if..

    export HISTCONTROL=ignorespace
..is set (either by default or explicitly)

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#100

Post by adrianmonk »

ianlevesque wrote: post #53
orasis wrote: post #46

Can someone please just provide the exact shell commands to generate a compatible sha-1 of a password to grep against the database? The article seems to ramble forever about how to perform online checks without discussing the basic offline secure option.

echo -n "password" | openssl sha1 | tr '[:lower:]' '[:upper:]'

You could skip the "tr" part, as the API to query by hash prefixes not case sensitive, and once you have its results, you can use "grep -i" with the hash.
Post reply on HN