So, the idea here, is that eventually every 8 character string winds up in Troy's special little database, and because HE has it in HIS special database, it should be off limits?
Hmmm... yesss... indeed.
86% of CrashCrate subscribers used passwords already leaked in other breaches
51–60 of 145 posts
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#52My hn username is a former password. After I committed it to memory it seemed a waste not to use it for something.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#53When I feel like a security goon's arbitrary and capricious password policy is irrational and counterproductive, I make my passwords worse in the hopes that I have to someday read it to someone, or perhaps it gets spilt outin the open, and then everyone will see how forcing me to pick a password that adheres to certain characteristics solved nothing. Just wait. Someday you will see dumps of pwnt password that look li…
I shamefully have to admit that I tried to logon to your (throw away) account using the list of passwords you supplied.
Username checks out I guess.
You and 50 others.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#54Stop giving your users passwords to Troy Hunt! Eg. hash and salt them! But use a really slow hash . Lets say the hashing speed is one hash per second, then it would take trillion years to brute force the password "hello".
You have that backwards. You don't bruteforce a single password. You compute the hashes of all the dictionary words and then compare the hashes. So your 'trillion years' is probably more along the lines of a few weeks, for all the words in the dictionary at once.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#5586% of my passwords are for low consequence sites. How much should I care if someone hacks my handle and posts ads on a chat site? Or reads registration-required articles under my registration? Or etc etc.
1. With a password manager, you don't have to think anymore if a site is high-consequence or low-consequence. 2. What kinds of websites that require a sign-in are actually low-consequence? I can't think of any from the top of my head, but that's probably because I'm pretty reluctant to sign up to new sites.
2. all sites/forums/whatever that require you to login to see a link, download stuff ... you get the idea.
Or probably: sites that don't involve money.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#56Earlier quoted context omitted.
How about a password manager? Or even better: Some kind of hardware token and a good standard that goes with it?
People should use password managers, but it's a crutch.
I'm not sure what you are saying ... should I memorize dozens of passwords like WCLfx(edI%uHgjWM6RuEeC6Qh for the services I use or should I strap on getting those dozens of services to use a perfect SSO service that doesn't leak privacy and is perfectly secure and doesn't exist yet?
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#57Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#58I'm still not sure why most services don't default to just mailing you a one time, short lived login link.
Because my password manager is faster than checking mail. Because spam. Because people change mails and may forget to let you know. Because bots scan emails and they are mostly in clear text.
> Because bots scan emails and they are mostly in clear text.
If the password reset email goes through the same route then this doesn't matter.
It's essentially a 'password reset' with every login. And because they are short lived you'd expect that if they had been used already that there would be no re-use possible, which would mean the attacker would have to be super fast and the victim would immediately know they were under attack.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#59Earlier quoted context omitted.
I guess this isn't typically based on cookies but device/browser fingerprinting.
Which is exactly what I'm trying to avoid. I don't want to be tracked so I try to limit the amount of fingerprinting possible.
But for this it is probably good that the services do fingerprint us - so that we understand how well it can work. Otherwise we'd assume that cleaning cookies is enough and wouldn't know how well that tracking works, not only when services that we knowingly use are doing it, but also when some actual black hats do it.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#6086% of my passwords are for low consequence sites. How much should I care if someone hacks my handle and posts ads on a chat site? Or reads registration-required articles under my registration? Or etc etc.
Maybe it's not such a big deal if someone hacks your account on one 'inconsequential' site, but what if they do it across 10, 20 'inconsequential' sites?
You may not give much away on one site, but combine all that data across multiple sites, and maybe I can start building a profile on you, identify you, impersonate you, steal your identity, etc.