Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The 111M Record Pemiblanc Credential Stuffing List

troyhunt.com

Post reply on HN
Print view View original

31–40 of 73 posts

Re: The 111M Record Pemiblanc Credential Stuffing List

#31

Post by dmckeon »

cgijoe wrote: post #6
chrisbolt wrote: post #2

These data breaches where the source isn't known can be frustrating. As someone who already uses unique passwords for everything, there's not much I can do (change 500+ passwords?). And I can understand Troy's argument[1] for not sharing the leaked password, so that doesn't leave many other options. I guess I'll just start going through my saved passwords and use them to delete all of the old accounts I rarely use, m…

Once the huge password Torrent is updated with Pemiblanc (9 GB, last updated March 1, 2018), you can download it and scan it for all your passwords locally. Then you can determine which are pwned. You'll have to SHA-256 them all, but that shouldn't be too hard.

Check out a lower bandwidth approach: https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...

Re: The 111M Record Pemiblanc Credential Stuffing List

#33

Post by talaketu »

soared wrote: post #19
djsumdog wrote: post #8

So in the past I've advocated password algorithms (sometimes called password formulas): https://penguindreams.org/blog/password-algorithms/ I felt like they could bridge the gap between a regular person who is weary of having to look up every password using a password manager (although a lot of them make it easier with browser plugins and phone apps, but it's still an extra step). However, in light of the recent Gent…

As someone technically literate but doesn't use a password manager: I sign up for a lot of services on one device (home laptop) and then need to use them on another device (work laptop, phone). How does a password manager work for this? I currently have about ~15 different passwords I use. I know which to use based on how long I've been using the service. Why is this strategy ineffective?? At most a hacker could get…

As long as you don't care if at most 4 of your accounts get hacked, then you have an effective strategy, I guess.

Re: The 111M Record Pemiblanc Credential Stuffing List

#34

Post by duxup »

>the rapid rise of the rapid rise of credential stuffing attacks

Maybe I was wrong but I always thought that was the "point"...

At least in the sense that as far as profitability goes the point of hacking or gaining access to a list of hacked passwords from say a boring site like some image sharing site was that you then take that and use it to do more nefarious things like access banking stuff, more sensitive identity related things, spying, etc.

Obviously there are folks out there hacking away for their own enlightenment or fun, but ultimately anyone looking to do more than that, I always thought the point was credential stuffing all along, otherwise who cares what someone's Flickr username and password is?

Re: The 111M Record Pemiblanc Credential Stuffing List

#35

Post by graystevens »

If the term Credential Stuffing is new to anyone, we’ve done a deep dive into what it is and the tools that are used here: https://breachinsider.com/blog/2017/credential-stuffing-how-...

We saw this pretty regularly at my old job, with attacks almost daily. They range from ‘script kiddie’ who just use the default tool settings and do it all from one IP making it easy to spot, to persistent attackers who would play cat and mouse with our live defences. They’d switch IPs using huge proxy lists found online every few minutes, as well as learn our alerting thresholds and attempt to fly just under the radar. For some reason though, they always seems to user UserAgents that were ancient, or weren’t real, allowing us to identify attack traffic compared to our normal user activity.

Re: The 111M Record Pemiblanc Credential Stuffing List

#37

Post by ecesena »

djsumdog wrote: post #8

So in the past I've advocated password algorithms (sometimes called password formulas): https://penguindreams.org/blog/password-algorithms/ I felt like they could bridge the gap between a regular person who is weary of having to look up every password using a password manager (although a lot of them make it easier with browser plugins and phone apps, but it's still an extra step). However, in light of the recent Gent…

Password algorithms, aka deterministic password managers, are usually pretty strong, specifically as strong as the master password(s) you use. Meaning that it’s usually easier to guess the mp than to reverse the algorithm.

Personally, I have different mp for different “security domains” (google/fb, banks, other socials, ...), and I’m using just a sha256 plus encoding — a trade off between requiring a stronger mp, and being able to easily remember everything, including the algorithm.

I wrote more about it here: https://hackernoon.com/mempa-a-modern-deterministic-password...

Re: The 111M Record Pemiblanc Credential Stuffing List

#38

Post by ubernostrum »

craftyguy wrote: post #26
sgarman wrote: post #13

Earlier quoted context omitted.

He loaded them into this site to check: https://haveibeenpwned.com/ I'm not sure troy shares the lists - for obvious reasons.

His site is basically one big advertisement for 1password now. I would not trust it.

What do you distrust?

Do you believe he's lying about the existence of certain breaches? Returning false results for whether a password is compromised? Be specific: what untrustworthy things do you suspect him of?

Re: The 111M Record Pemiblanc Credential Stuffing List

#39

Post by ubernostrum »

dannyw wrote: post #30
craftyguy wrote: post #26

Earlier quoted context omitted.

His site is basically one big advertisement for 1password now. I would not trust it.

I'm not sure why you're being downvoted when you're exactly right. I have lost a lot of respect for Troy Hunt when he pretty much turned his blog and HIBP into a native advertisement for 1Password; without any disclosure that he is being paid by 1Password.

I'm looking at: https://haveibeenpwned.com/

I see a link below the search box, which when I click explains he has "partnered" with 1Password, why, and why he liked it prior to the partnership. It also links to this:

https://www.troyhunt.com/have-i-been-pwned-is-now-partnering...

which has a lot more detail.

That's not what I call "without any disclosure". And makes me wonder what your idea of "disclosure" would be.

Re: The 111M Record Pemiblanc Credential Stuffing List

#40

Post by dorfsmay »

soared wrote: post #19
djsumdog wrote: post #8

So in the past I've advocated password algorithms (sometimes called password formulas): https://penguindreams.org/blog/password-algorithms/ I felt like they could bridge the gap between a regular person who is weary of having to look up every password using a password manager (although a lot of them make it easier with browser plugins and phone apps, but it's still an extra step). However, in light of the recent Gent…

As someone technically literate but doesn't use a password manager: I sign up for a lot of services on one device (home laptop) and then need to use them on another device (work laptop, phone). How does a password manager work for this? I currently have about ~15 different passwords I use. I know which to use based on how long I've been using the service. Why is this strategy ineffective?? At most a hacker could get…

Password managers across devices:

Either use a service that syncs up to a server, or a standalone apps and save its encrypted database to a shared filesystem such as Dropbox or pcloud.

Post reply on HN