> However, I got a lot of feedback from V1 along the lines of "simply blocking 320M passwords is a usability nightmare". Blocking half a billion, even more so.
What, why?
"Pwned Passwords" V2 With Half a Billion Passwords
191–200 of 369 posts
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#192Re: "Pwned Passwords" V2 With Half a Billion Passwords
#193> However, I got a lot of feedback from V1 along the lines of "simply blocking 320M passwords is a usability nightmare". Blocking half a billion, even more so. What, why?
Because normal humans will only be able to generate so many passwords on their own before they give up.
He also later makes the example of understanding the frequency matters — abc123 is mathematically equivalently bad to mno678, except one is far more likely than the other.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#194https://mostsecure.pw/ No pwnage found. Still confirmed for most secure password.
...this is a joke, right?
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#195The UX of a blacklist with a half billion entries would be so crippling that it would cause a user revolt. Most people's password-selection strategies are similar enough to other people's (like kbenson's 4000+ hit) that they could spend hours trying to come up with a password that has never been leaked before. I tried to encourage Troy to suggest to implementors that blacklisting all passwords was a Bad Idea. Instead…
Keep in mind a lot of these passwords are associated with email addresses in the actual dumps. By allowing a user to use one of these passwords, there's a non-negligible chance you're knowingly allowing them to use a username/password combo that is publicly available, and that any hacker who wanted to compromise their account could do so _on their first try_. Besides, when it comes to passwords... half a billion real…
Some large services do use the actual dumps, and correlate them with the email address associated with the current user, in order to give users a personalized warning that they're reusing a leaked password that's already associated with that specific email address. This is a much different proposition from forbidding that specific user from using a half a billion passwords.
A full 80% of the v1 corpus can be avoided by simply requiring a minimum password length of 12. As Troy has pointed out elsewhere, this wouldn't be great UX, either. While it would dramatically increase the chances that they came up with a word that would be A) not in the existing blacklist, and B) harder to attack offline ... it would still be significantly bad UX compared to the best-practice alternative that I lay out in a separate thread branch.
But it would still be much better UX than use of the full blacklist.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#196Re: "Pwned Passwords" V2 With Half a Billion Passwords
#197do not skip the section on "Cloudflare, Privacy and k-Anonymity" ... it is a great summary of an elegant privacy solution. And check out Cloudflare's detail post too: https://blog.cloudflare.com/validating-leaked-passwords-with...
A warning about Cloudflare: You cannot access their support in any way without logging in. Trying to contact them via their contact/sales page won't work. They won't respond. This means that if you lose your phone (2FA) and can't log in, you're royally screwed and will have to go to your registrar to recover access to your domains/DNS.
You should never use only 2FA for something you don't want to be locked out of. You need a 3rd authentication method to replace the 2nd when you lose it, such as backup codes, that as well as a 4th one to recover a lost password.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#198Earlier quoted context omitted.
As a policy Troy Hunt won't reveal which breach he found your data in. I considered setting up a series of 'canary' emails so that I could track who's selling what but ... well never got round to it.
You used to be able to adjust your email address to check. For example if you email was bill@gmail.com, you could sign up for HN with bill+hackernews@gmail.com. Gmail ignores the part after the + sign. Therefore if you noticed emails coming to that address, you would know that HN sold their list. However, I've found that most forms reject that as a non-valid email address now.
This is why I configured my dovecot instance to use - instead of + for the mailbox delimeter
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#199Earlier quoted context omitted.
moms are loved almost 3 times more.
Or people who love their moms are 3 times more likely to choose a bad password.
People who love their moms are less intelligent than those who love their dads? There is a dissertation in psychoanalytics just waiting to be written.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#200Earlier quoted context omitted.
Or people who love their moms are 3 times more likely to choose a bad password.
People who love their moms are less intelligent than those who love their dads? There is a dissertation in psychoanalytics just waiting to be written.
I think it lines up well with existing theories, that of the oedipal complex combined with the idea that women are smarter.