Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

Post reply on HN
Print view View original

121–130 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#121

Post by scrollaway »

baliex wrote: post #102
scrollaway wrote: post #27

[Pasting an old comment of mine on password managers, since I see people talking about starting to use Keepass. I hope this helps someone] ---- If you're just starting, here's some guidance on setting up a password manager. First of all: Don't be afraid of using one. It's not just more secure, it's super convenient. Never again will you ask yourself: Did I make an account for this website/service? What email did I us…

iOS has https://github.com/MiniKeePass/MiniKeePass , available on the app store.

Thanks for the heads up! Have you used it? What do you know about it?

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#122

Post by xeonoex »

sachleen wrote: post #7
roymurdock wrote: post #3

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

Long time lastpass user recently switched to BitWarden. I find it's UI to be cleaner/easier to use

How is BitWardens UX on mobile? Does it support autofill and automatically adding/updating passwords you enter on apps or the browser?

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#124

Post by Lxr »

ChrisSD wrote: post #41
Lxr wrote: post #38

Earlier quoted context omitted.

Can you clarify what problem this solves?

As stated in the post, it's a simple solution to help with anonymity. "The password has been hashed client side and just the first 5 characters passed to the API As mentioned earlier, there are 475 hashes beginning with "21BD1", but only 1 which matches the remainder of the hash for "P@ssw0rd" and that record indicates that the password has previously been seen 47,205 times."

Forgive my ignorance but why is submitting a hash a problem? Because Troy knows which passwords have been checked? Why should I care about that? I get that it’s like submitting your password in the clear if it’s in the DB, but in that case surely you have bigger problems.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#125

Post by cdubzzz »

scrollaway wrote: post #121
baliex wrote: post #102

Earlier quoted context omitted.

iOS has https://github.com/MiniKeePass/MiniKeePass , available on the app store.

Thanks for the heads up! Have you used it? What do you know about it?

I use it regularly. The only real drawback is that the database has to be updated manually (e.g. from DropBox or wherever). Outside of that issue it has lots of features and config options and is generally easy to use.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#126

Post by giarc »

anitil wrote: post #113
dopamean wrote: post #69

An old password (12 char numbers and letters) I've since stopped using (but used to use everywhere) appears as pwned in this list (3 times!). I'd love to know who exposed it. Any chance I can find out?

As a policy Troy Hunt won't reveal which breach he found your data in. I considered setting up a series of 'canary' emails so that I could track who's selling what but ... well never got round to it.

You used to be able to adjust your email address to check. For example if you email was bill@gmail.com, you could sign up for HN with bill+hackernews@gmail.com. Gmail ignores the part after the + sign. Therefore if you noticed emails coming to that address, you would know that HN sold their list. However, I've found that most forms reject that as a non-valid email address now.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#127

Post by pfg »

Lxr wrote: post #124
ChrisSD wrote: post #41

Earlier quoted context omitted.

As stated in the post, it's a simple solution to help with anonymity. "The password has been hashed client side and just the first 5 characters passed to the API As mentioned earlier, there are 475 hashes beginning with "21BD1", but only 1 which matches the remainder of the hash for "P@ssw0rd" and that record indicates that the password has previously been seen 47,205 times."

Forgive my ignorance but why is submitting a hash a problem? Because Troy knows which passwords have been checked? Why should I care about that? I get that it’s like submitting your password in the clear if it’s in the DB, but in that case surely you have bigger problems.

One way that sites can use this service is to check whether a password has been leaked when users sign up. By handing over the SHA-1 hash of the password you're effectively trusting this service (and anyone who might have compromised it) with all your user's clear text passwords. Connecting the right password with the right user can be trivial in some circumstances, say because a site has a publicly visible sign-up date on profiles, or even if it just hands out sequential IDs to users.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#128

Post by Bromskloss »

anitil wrote: post #113
dopamean wrote: post #69

An old password (12 char numbers and letters) I've since stopped using (but used to use everywhere) appears as pwned in this list (3 times!). I'd love to know who exposed it. Any chance I can find out?

As a policy Troy Hunt won't reveal which breach he found your data in. I considered setting up a series of 'canary' emails so that I could track who's selling what but ... well never got round to it.

How does he get hold of the data in the first place?

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#129

Post by ufo »

yarwelp_ wrote: post #11

On the topic of passwords, have a look at my command-line passphrase generation program. GitHub: https://github.com/ctsrc/pgen It's written in Rust. Install the Rust toolchain installer from https://rustup.rs/ curl https://sh.rustup.rs -sSf | sh And remember to add ~/.cargo/bin to your PATH. Then install my command-line utility cargo install pgen Usage is described in detail in the README on GitHub. Additionally you…

I think I would have a hard time memorizing 12 word passphrases

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#130

Post by richdougherty »

Ajedi32 wrote: post #60
jkaptur wrote: post #33

Earlier quoted context omitted.

I'm a bit confused - why not distribute a serialized Bloom filter representing these passwords? That would seem to enable a compact representation (low Azure bill) and client-side querying (maximally preserving privacy).

There are half a billion passwords in the list. A bloom filter with even a 1 in 10 false positive rate would still be 286.59 MB.

You could do a Bloom filter on each bucket, each of which has about 500 items. This would reduce the size of the response from about 16k to < 1k. But it would be a lot harder to use since all clients would have to use the Bloom filter code correctly.
Post reply on HN