Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

86% of CrashCrate subscribers used passwords already leaked in other breaches

troyhunt.com

Post reply on HN
Print view View original

41–50 of 145 posts

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#41

Post by giancarlostoro »

gnud wrote: post #25
buro9 wrote: post #17

Earlier quoted context omitted.

What I do is similar. I use auth0, and have it configured for passwordless use. If you have a Google Account or Microsoft Account then you can simply use the OIDC / OAuth flow and have those third parties that you trust identify you and handle the authentication... we only ask for an email as it's necessary for our service. Because it's only auth0 talking to the identity provider, Google and Microsoft don't actually…

Just a side note: Password managers are not useless in private browsing. I use KeePass and Kee for firefox, and it works the same in private browsing as in "normal" browsing.

They meant getting a new login password emailed to you.

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#42

Post by systemtest »

charDiversity wrote: post #37

When I feel like a security goon's arbitrary and capricious password policy is irrational and counterproductive, I make my passwords worse in the hopes that I have to someday read it to someone, or perhaps it gets spilt outin the open, and then everyone will see how forcing me to pick a password that adheres to certain characteristics solved nothing. Just wait. Someday you will see dumps of pwnt password that look li…

I shamefully have to admit that I tried to logon to your (throw away) account using the list of passwords you supplied.

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#43

Post by buro9 »

giancarlostoro wrote: post #41
gnud wrote: post #25

Earlier quoted context omitted.

Just a side note: Password managers are not useless in private browsing. I use KeePass and Kee for firefox, and it works the same in private browsing as in "normal" browsing.

They meant getting a new login password emailed to you.

I had edited to clarify, gnud was right in his reply as my original wasn't as clear.

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#44

Post by stevekemp »

saimiam wrote: post #23
raverbashing wrote: post #13

Earlier quoted context omitted.

People should use password managers, but it's a crutch.

I do this but I'd love to have someone tell me why this is a terrible idea (apart from the obvious one of using a 3rd party sha256 calculator) 1. Have a very short prefix and a suffix I can expect to remember 2. Password for every website gets generated like this + website name + 3. Generate SHA256 hash of #2 4. Use #3 as password for the site. 5. Save password to password manager Pros - 1. losing a password on one s…

At some point a site you use will be compromised, so you have a problem as that site will require a new password.

So your login routine is now:

* Generate your password via hash(prefix + sitename + suffix), and use it on every site, except that compromised one. Because it invalidated your old password and won't let you reuse it.

In short you have a versioning problem. And you have to remember it. The problem compounds for each site you use which insists upon a change for whatever reason.

(Also your own "con" - different sites have different restrictions/caveats for password formats.)

Use a password-manager, it really is the best way to have a unique and secure password for each site.

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#45

Post by saimiam »

pryce wrote: post #30
saimiam wrote: post #23

Earlier quoted context omitted.

I do this but I'd love to have someone tell me why this is a terrible idea (apart from the obvious one of using a 3rd party sha256 calculator) 1. Have a very short prefix and a suffix I can expect to remember 2. Password for every website gets generated like this + website name + 3. Generate SHA256 hash of #2 4. Use #3 as password for the site. 5. Save password to password manager Pros - 1. losing a password on one s…

1. This relies on a mistaken expectation that all sites you use being able to accept SHA256 output - presumably in Base64 or similar- as an acceptable password. You will likely have to compromise this. 2. You have no credential expiry built into this approach. Even should you decide to not use credential expiry, if one site demands it, your strategy doesn't work. 3. You are still at risk of having your passwords leak…

> credential expiry

Good point. I'll have to add something to prefix of prefix/suffix for sites which remember previous passwords (or hashes).

> leaving any traces in logs

This I will have to resolve by localizing my sha256 generation process.

> over the shoulder

Also a good point.

Thank you for thinking this through for me. Appreciate it.

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#46

Post by lostcolony »

majewsky wrote: post #18
dzdt wrote: post #15

86% of my passwords are for low consequence sites. How much should I care if someone hacks my handle and posts ads on a chat site? Or reads registration-required articles under my registration? Or etc etc.

1. With a password manager, you don't have to think anymore if a site is high-consequence or low-consequence. 2. What kinds of websites that require a sign-in are actually low-consequence? I can't think of any from the top of my head, but that's probably because I'm pretty reluctant to sign up to new sites.

What kinds of website would require a throwaway email address?

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#47

Post by saimiam »

stevekemp wrote: post #44
saimiam wrote: post #23

Earlier quoted context omitted.

I do this but I'd love to have someone tell me why this is a terrible idea (apart from the obvious one of using a 3rd party sha256 calculator) 1. Have a very short prefix and a suffix I can expect to remember 2. Password for every website gets generated like this + website name + 3. Generate SHA256 hash of #2 4. Use #3 as password for the site. 5. Save password to password manager Pros - 1. losing a password on one s…

At some point a site you use will be compromised, so you have a problem as that site will require a new password. So your login routine is now: * Generate your password via hash(prefix + sitename + suffix), and use it on every site, except that compromised one. Because it invalidated your old password and won't let you reuse it. In short you have a versioning problem. And you have to remember it. The problem compound…

> use a pw manager

I do use my Mac's Keychain Access. My issue started when I had to use a work computer for logging into a newspaper account and I couldn't remember what it was because it was saved on my personal laptop. That's when I came up with this scheme.

> versioning problem

Someone else pointed this out as well. Thanks for thinking this thru.

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#48

Post by OskarS »

dzdt wrote: post #15

86% of my passwords are for low consequence sites. How much should I care if someone hacks my handle and posts ads on a chat site? Or reads registration-required articles under my registration? Or etc etc.

If you ever reuse that password anywhere else, then you should care A LOT. If you go "i only reuse passwords on low-consequence sites", then I have to ask you 1) why reuse at all? and 2) are you sure? I bet that that's not true, I bet you think that's true but it turns out that your Uber password is the same as your RandomSite password.

Just use a password manager. It's easier and it's safer, and you never have to think "is this a low consequence site?" ever again, because you'll have high quality passwords everywhere. It's really the only way to be sure you have unique and strong passwords everywhere.

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#49

Post by rocannon »

majewsky wrote: post #18
dzdt wrote: post #15

86% of my passwords are for low consequence sites. How much should I care if someone hacks my handle and posts ads on a chat site? Or reads registration-required articles under my registration? Or etc etc.

1. With a password manager, you don't have to think anymore if a site is high-consequence or low-consequence. 2. What kinds of websites that require a sign-in are actually low-consequence? I can't think of any from the top of my head, but that's probably because I'm pretty reluctant to sign up to new sites.

I had a login at a game website called Shakes & Fidget years ago. The site itself is low-consequence. I wouldn't care if someone hacked my login. Another example is when I'm just trying some service and don't expect to use it ever again.

What would worry me is if people hack the login for a low-consequence site and then figure out that those login credentials for this user are the same everywhere: at their bank, Amazon, etc. Personally, I use different passwords at every single website, but at low-consequence websites I sometimes use less secure ones. I don't see how this is a problem (for me).

I understand why low-consequence sites do not implement schemes to force users to use stronger passwords, though. Howls of outrage, lost users, and attempts to get around it, as charDiversity says: https://news.ycombinator.com/item?id=16975773

Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches

#50

Post by Sir_Cmpwn »

z3t4 wrote: post #34

Stop giving your users passwords to Troy Hunt! Eg. hash and salt them! But use a really slow hash . Lets say the hashing speed is one hash per second, then it would take trillion years to brute force the password "hello".

I don't think you understand how he gets ahold of these passwords. They're from dumps of leaked databases.
Post reply on HN