Where can I download the list? I want to see what password was shared.
The 111M Record Pemiblanc Credential Stuffing List
11–20 of 73 posts
Re: The 111M Record Pemiblanc Credential Stuffing List
#12Earlier quoted context omitted.
Once the huge password Torrent is updated with Pemiblanc (9 GB, last updated March 1, 2018), you can download it and scan it for all your passwords locally. Then you can determine which are pwned. You'll have to SHA-256 them all, but that shouldn't be too hard.
I've never tried to follow up with which accounts/passwords have been used from haveibeenpwned, can you describe this further as I'll try this. The "huge pw torrent" is something I can just search on torrent trackers? Once I have the list, its just a list of passwords, or includes the emails? Then they're sha-256 hashed and I need to ..unhash them?
I also want to see this.
Re: The 111M Record Pemiblanc Credential Stuffing List
#13Where can I download the list? I want to see what password was shared.
He loaded them into this site to check: https://haveibeenpwned.com/
I'm not sure troy shares the lists - for obvious reasons.
Re: The 111M Record Pemiblanc Credential Stuffing List
#14Where can I download the list? I want to see what password was shared.
He loaded them into this site to check: https://haveibeenpwned.com/ I'm not sure troy shares the lists - for obvious reasons.
It wouldn't be a hack if it wasn't available. I can run through the hashes. I just want the list without having to jump through a bunch of hoops and pay someone to get it.
Re: The 111M Record Pemiblanc Credential Stuffing List
#15So in the past I've advocated password algorithms (sometimes called password formulas): https://penguindreams.org/blog/password-algorithms/ I felt like they could bridge the gap between a regular person who is weary of having to look up every password using a password manager (although a lot of them make it easier with browser plugins and phone apps, but it's still an extra step). However, in light of the recent Gent…
A variation on the password algorithm: Generate half of your password by using the algorithm. Create the other half, one per site, using a random algorithm, and write it on a piece of paper (if the site has stupid "security" requirements for the password, you can usually fit these into your random string).
To regenerate your passwords, an adversary would need both to figure out your algorithm and obtain your piece of paper.
Re: The 111M Record Pemiblanc Credential Stuffing List
#16Earlier quoted context omitted.
Once the huge password Torrent is updated with Pemiblanc (9 GB, last updated March 1, 2018), you can download it and scan it for all your passwords locally. Then you can determine which are pwned. You'll have to SHA-256 them all, but that shouldn't be too hard.
I've never tried to follow up with which accounts/passwords have been used from haveibeenpwned, can you describe this further as I'll try this. The "huge pw torrent" is something I can just search on torrent trackers? Once I have the list, its just a list of passwords, or includes the emails? Then they're sha-256 hashed and I need to ..unhash them?
I think he is referring to Troy Hunts pwned password list.(which is about 9gb, afaik) Presumably it will be updated with these new plaintext passwords.
Once it’s updated, you can check all your passwords against the list. It’s a list of sha256-hashed passwords.(so he isn’t sharing tons of plaintext passwords, as sha256 can’t be reversed) You would sha256 your own passwords and check them all against the list.
Edit: to clarify, I think there are tools to help check against the offline list pretty easily. Or you could also query Troy hunts pwned password page (or its api)once it’s updated; instead of downloading 9gb. The k-anonymity model is pretty clever, and querying the site should be secure.
Re: The 111M Record Pemiblanc Credential Stuffing List
#17So in the past I've advocated password algorithms (sometimes called password formulas): https://penguindreams.org/blog/password-algorithms/ I felt like they could bridge the gap between a regular person who is weary of having to look up every password using a password manager (although a lot of them make it easier with browser plugins and phone apps, but it's still an extra step). However, in light of the recent Gent…
A variation on the password algorithm: Generate half of your password by using the algorithm. Create the other half, one per site, using a random algorithm, and write it on a piece of paper (if the site has stupid "security" requirements for the password, you can usually fit these into your random string). To regenerate your passwords, an adversary would need both to figure out your algorithm and obtain your piece of…
If you're already writing half the password on a piece of paper wouldn't it be safer to generate the whole password randomly and write that down?
Re: The 111M Record Pemiblanc Credential Stuffing List
#18Earlier quoted context omitted.
Gmail and other MTAs support +something in the e-mail address user part too. If you forget your password, you do have to dig through your e-mail and figured out which one you used, but this method does let you track down when someone sells/shares your e-mail address or 3rd parties.
You just have to remember the exact username/email you used in case you forget it. That can include the sitename itself, or some simple transform, but sometimes services change names... so make sure to keep records of exactly the email used for each service (or don't delete your email from them), forgetting that is worse than losing the password, since there's often no helpful recovery service they offer.
The bigger problem is MANY MANY sites don't accept the (+) in an email address.
Re: The 111M Record Pemiblanc Credential Stuffing List
#19So in the past I've advocated password algorithms (sometimes called password formulas): https://penguindreams.org/blog/password-algorithms/ I felt like they could bridge the gap between a regular person who is weary of having to look up every password using a password manager (although a lot of them make it easier with browser plugins and phone apps, but it's still an extra step). However, in light of the recent Gent…
As someone technically literate but doesn't use a password manager: I sign up for a lot of services on one device (home laptop) and then need to use them on another device (work laptop, phone). How does a password manager work for this?
I currently have about ~15 different passwords I use. I know which to use based on how long I've been using the service. Why is this strategy ineffective?? At most a hacker could get 3-4 of the services I use, and even then they'd need to find each of those services out of the hundreds I use. I also have 4 different emails I use for logins.
Re: The 111M Record Pemiblanc Credential Stuffing List
#20So in the past I've advocated password algorithms (sometimes called password formulas): https://penguindreams.org/blog/password-algorithms/ I felt like they could bridge the gap between a regular person who is weary of having to look up every password using a password manager (although a lot of them make it easier with browser plugins and phone apps, but it's still an extra step). However, in light of the recent Gent…
As someone technically literate but doesn't use a password manager: I sign up for a lot of services on one device (home laptop) and then need to use them on another device (work laptop, phone). How does a password manager work for this? I currently have about ~15 different passwords I use. I know which to use based on how long I've been using the service. Why is this strategy ineffective?? At most a hacker could get…
Personally, I use LastPass across browsers in multiple desktop accounts and my mobile browser, with no issue. You create a LastPass account, presumably with a very secure password, that you can log into elsewhere.
As for the password strategy, I imagine you could be vulnerable if any two important accounts - say, email and bank - both used the same password. Are you confident this is not the case?
I assume certain emails associate with certain types of accounts, which could flaw your strategy. If you're able to remember ~15 different passwords with random emails, congrats on your stellar memory!