Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

Post reply on HN
Print view View original

171–180 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#171

Post by kbenson »

royce wrote: post #156
kbenson wrote: post #153

Earlier quoted context omitted.

> I tried to encourage Troy to suggest to implementors that blacklisting all passwords was a Bad Idea. Instead, he doubled down > Please don't use the entire list for blacklisting unless you actively also guide the user in how to generate a random passphrase (if a human must remember it) or a random password (if it will be stored in a password manager). I think he did the right thing, and think you are correct as wel…

As a corpus to download for password research, this is indeed useful. But for providing a blacklist -- his stated purpose - it is not. The crucial tell: his API does not allow the implementor to specify a frequency threshold (by top X in the list, or by Y number of unique uses of the password or higher). By both API and explicit language in the announcement, he is promulgating the idea that checking the entire blackl…

> his API does not allow the implementor to specify a frequency threshold

Yes it does. The output contains the number of matching passwords. It's just client side instead of server side. The reason for not doing so on the server is also obvious taking into account his explanation of cost and caching, which informed much of the API design itself.

> By both API and explicit language in the announcement, he is promulgating the idea that checking the entire blacklist is useful

Because the entire blacklist is useful. He's given all the relevant information to the client to do with as they may. It's up to them to choose how to utilize it. I'm not sure why you seem to think some narrower use case is necessarily better, using end use cases as arguments, given it's an API and needs a client implementation fore being usable anyway.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#172

Post by w8rbt »

jkaptur wrote: post #33
groovecoder wrote: post #19

do not skip the section on "Cloudflare, Privacy and k-Anonymity" ... it is a great summary of an elegant privacy solution. And check out Cloudflare's detail post too: https://blog.cloudflare.com/validating-leaked-passwords-with...

I'm a bit confused - why not distribute a serialized Bloom filter representing these passwords? That would seem to enable a compact representation (low Azure bill) and client-side querying (maximally preserving privacy).

I agree. Just need to set some bits and test them. This is too big really for a tree or a hash table.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#173

Post by varenc »

royce wrote: post #143

The UX of a blacklist with a half billion entries would be so crippling that it would cause a user revolt. Most people's password-selection strategies are similar enough to other people's (like kbenson's 4000+ hit) that they could spend hours trying to come up with a password that has never been leaked before. I tried to encourage Troy to suggest to implementors that blacklisting all passwords was a Bad Idea. Instead…

Dropbox's zxcvbn password-strength estimator already incorporates a list of 250k+ common passwords and words. No need to make a separate blacklist check unless you want to check more than what zxcvbn already does. (and you could enforce it more strongly on the server instead of locally in JS like zxcvbn)

For reference, these are the passwords and common words zxcvbn already checks against: https://github.com/dropbox/zxcvbn/tree/master/data

And with zxcvbn it'll still flag a password as low entropy/low security if the password it's checking is just a simple modification of something on the common password list.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#174

Post by colorcoded »

scrollaway wrote: post #27

[Pasting an old comment of mine on password managers, since I see people talking about starting to use Keepass. I hope this helps someone] ---- If you're just starting, here's some guidance on setting up a password manager. First of all: Don't be afraid of using one. It's not just more secure, it's super convenient. Never again will you ask yourself: Did I make an account for this website/service? What email did I us…

I use keepass, and I whipped up a quick script to look all the passwords in my keepass file against the hashes in the list. You have to download and unpack the file first.

Here is my script: https://gist.github.com/martinhansdk/de8b27934adf9580aebf2e4...

I got a bunch of hits, so time to change some passwords...

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#175

Post by royce »

kbenson wrote: post #171
royce wrote: post #156

Earlier quoted context omitted.

As a corpus to download for password research, this is indeed useful. But for providing a blacklist -- his stated purpose - it is not. The crucial tell: his API does not allow the implementor to specify a frequency threshold (by top X in the list, or by Y number of unique uses of the password or higher). By both API and explicit language in the announcement, he is promulgating the idea that checking the entire blackl…

> his API does not allow the implementor to specify a frequency threshold Yes it does. The output contains the number of matching passwords. It's just client side instead of server side. The reason for not doing so on the server is also obvious taking into account his explanation of cost and caching, which informed much of the API design itself. > By both API and explicit language in the announcement, he is promulgat…

It's a fair point that raw password count is available.

But that value is an absolute number, without any in-API context of the total size of the corpus. This makes expressing relative rarity only possible by hard-coding the total size of the corpus into a calculation.

Put another way: the 20,000th position has a frequency value of "7889". But what does that mean? Where is that in the distribution of password frequency? It's impossible to tell, without manually constructed context that will change over time as the total number of passwords in his corpus expands.

But more crucially, there is no way to tell relative rank ("is this password in the top 20k?") using the API that I can see. That would make using the top X much easier. But with the K-anonymity "feature", there's no way to do that that I can see.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#177

Post by u801e »

What would be nice is if we could improve the process of generating per device client side certificates that can be associated with a user account. Then we could just use certificate based authentication (and add on password based authentication if we want a second authentication factor).

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#178

Post by [deleted] »

ivanech wrote: post #170

I think it would be interesting to do an art project with this data - some of these passwords are funny and/or revealing. Some examples: pooplasagna - 3 times eggsarebad - 3 times eggsaregood - 25 times myhusbandcheats - 4 times icheatonmywife - 1 time ihatemyneighbors - 2 times iamanalcoholic - 6 times 1yearsober - 31 times imissmykids - 51 times imissmyparents - 6 times

[deleted]

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#179

Post by tlrobinson »

kalleboo wrote: post #139
giarc wrote: post #126

Earlier quoted context omitted.

You used to be able to adjust your email address to check. For example if you email was bill@gmail.com, you could sign up for HN with bill+hackernews@gmail.com. Gmail ignores the part after the + sign. Therefore if you noticed emails coming to that address, you would know that HN sold their list. However, I've found that most forms reject that as a non-valid email address now.

I use a catchall address on my own domain name, and use sitename@domain.com to sign up for everything. You should be using your own domain for email anyway

> You should be using your own domain for email anyway

Why?

I trust Google to secure gmail.com better than I can secure my own domain.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#180

Post by fny »

ivanech wrote: post #170

I think it would be interesting to do an art project with this data - some of these passwords are funny and/or revealing. Some examples: pooplasagna - 3 times eggsarebad - 3 times eggsaregood - 25 times myhusbandcheats - 4 times icheatonmywife - 1 time ihatemyneighbors - 2 times iamanalcoholic - 6 times 1yearsober - 31 times imissmykids - 51 times imissmyparents - 6 times

    ilovemymom 20141
    ilovemydad  7850
Post reply on HN