https://mostsecure.pw/
No pwnage found. Still confirmed for most secure password.
"Pwned Passwords" V2 With Half a Billion Passwords
181–190 of 369 posts
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#182The UX of a blacklist with a half billion entries would be so crippling that it would cause a user revolt. Most people's password-selection strategies are similar enough to other people's (like kbenson's 4000+ hit) that they could spend hours trying to come up with a password that has never been leaked before. I tried to encourage Troy to suggest to implementors that blacklisting all passwords was a Bad Idea. Instead…
All depends on the threat model.
Reusing username/email/password can cost your users hundreds per day on a gambling site. And users don't care about a password-gen guide. For example, in that case, you'd want to consider just generating passwords for them.
But of course this would be silly for the run of the mill website.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#183Earlier quoted context omitted.
Another way is to prefix the command with whitespace.
Only if.. export HISTCONTROL=ignorespace ..is set (either by default or explicitly)
python3 -c 'import getpass, hashlib; print(hashlib.sha1(getpass.getpass().encode("utf-8")).hexdigest())'
In fact, you should be able to just make a rudimentary CLI into Troy's API simply with:
#!/bin/bash
HASH="$(python3 -c 'import getpass, hashlib; print(hashlib.sha1(getpass.getpass().encode("utf-8")).hexdigest().upper())')"
curl -sS "https://api.pwnedpasswords.com/range/${HASH:0:5}" | grep "${HASH:5}"
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#184Earlier quoted context omitted.
I use a catchall address on my own domain name, and use sitename@domain.com to sign up for everything. You should be using your own domain for email anyway
> You should be using your own domain for email anyway Why? I trust Google to secure gmail.com better than I can secure my own domain.
(a) Using your own domain doesn't require using your own mail server, you can point your mx server at Google apps if you're comfortable or your registrar probably supports mail forward if you don't want to pay for G Suite.
(B) it means you can keep your email address if you ever leave Gmail.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#185do not skip the section on "Cloudflare, Privacy and k-Anonymity" ... it is a great summary of an elegant privacy solution. And check out Cloudflare's detail post too: https://blog.cloudflare.com/validating-leaked-passwords-with...
A warning about Cloudflare: You cannot access their support in any way without logging in. Trying to contact them via their contact/sales page won't work. They won't respond. This means that if you lose your phone (2FA) and can't log in, you're royally screwed and will have to go to your registrar to recover access to your domains/DNS.
All of that is a good thing in my book. I've been the victim of the "customer service backdoor" on Amazon multiple times. It's ridiculous that someone can just about credentialize as you without even having to log in. They made off with whatever sensitive data the customer service rep had in front of them just from chatting to someone on that anonymous support chat widget.
Meanwhile, all you have to do is backup your 2FA secrets. Why not make it a part of your regular computer backup routine?
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#186The UX of a blacklist with a half billion entries would be so crippling that it would cause a user revolt. Most people's password-selection strategies are similar enough to other people's (like kbenson's 4000+ hit) that they could spend hours trying to come up with a password that has never been leaked before. I tried to encourage Troy to suggest to implementors that blacklisting all passwords was a Bad Idea. Instead…
Keep in mind a lot of these passwords are associated with email addresses in the actual dumps. By allowing a user to use one of these passwords, there's a non-negligible chance you're knowingly allowing them to use a username/password combo that is publicly available, and that any hacker who wanted to compromise their account could do so _on their first try_.
Besides, when it comes to passwords... half a billion really isn't all that much. There are (26*2+10)^8 = ~218 _trillion_ possible 8-character alphanumeric passwords. So even if every single one of these half a billion passwords were 8-characters long, you'd still only be disallowing ~0.0002% of them.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#187Earlier quoted context omitted.
I love Dashlane, and the Linux support is solid through the browser extension. Dashlane has the best interface across devices, of all the password managers I've used. The password sharing feature is great for business. Sure, it's a cloud service, but it's polished enough that I can get non-tech people like my family and coworkers to actually use it. Lastpass did not pass that test. I use Dashlane every day on Mac, Li…
Thanks. One question I have - can you turn off auto-login globally or just on a per website basis? Docs seem to imply on a per site basis only but that seems a bit odd. I'm wondering how DashLane handles multiple logins for the same service (Google/GitHub etc etc).
I'm not sure about the global option, I've never tried.
For multiple logins on the same service/domain, it presents a clickable/tappable list.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#188do not skip the section on "Cloudflare, Privacy and k-Anonymity" ... it is a great summary of an elegant privacy solution. And check out Cloudflare's detail post too: https://blog.cloudflare.com/validating-leaked-passwords-with...
A warning about Cloudflare: You cannot access their support in any way without logging in. Trying to contact them via their contact/sales page won't work. They won't respond. This means that if you lose your phone (2FA) and can't log in, you're royally screwed and will have to go to your registrar to recover access to your domains/DNS.
If support can bypass 2FA why even have it?
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#189Earlier quoted context omitted.
You used to be able to adjust your email address to check. For example if you email was bill@gmail.com, you could sign up for HN with bill+hackernews@gmail.com. Gmail ignores the part after the + sign. Therefore if you noticed emails coming to that address, you would know that HN sold their list. However, I've found that most forms reject that as a non-valid email address now.
Don't any half decent sites strip that out anyways? Some ecommerce sites have actually failed to accept that string, inadvertently thinking it's invalid. The rest, or any marketing CMS, would simply remove it.
Why would you modify valid user input?
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#190I think it would be interesting to do an art project with this data - some of these passwords are funny and/or revealing. Some examples: pooplasagna - 3 times eggsarebad - 3 times eggsaregood - 25 times myhusbandcheats - 4 times icheatonmywife - 1 time ihatemyneighbors - 2 times iamanalcoholic - 6 times 1yearsober - 31 times imissmykids - 51 times imissmyparents - 6 times
ilovemymom 20141 ilovemydad 7850
moms are loved almost 3 times more.