Prevent users registering with passwords from data breaches
jordanhall.co.uk
Prevent users registering with passwords from data breaches
1–10 of 129 posts
Re: Prevent users registering with passwords from data breaches
#2You don't even need to call out to an external API to get good coverage for this rule, in case you're averse to doing such a thing.
You can just do a case-insensitive match against this file that I compiled a while back: https://github.com/robsheldon/bad-passwords-index
It includes the most commonly reused passwords according to in-the-wild breaches.
I'm a bit embarrassed to see that it's been 2 years since the last update. I was thinking recently about updating this again. I think I'll do that.
Re: Prevent users registering with passwords from data breaches
#3If you allow each user to try 200 million different passwords when they want to log in, you have bigger problems.
Re: Prevent users registering with passwords from data breaches
#4And I thought we were getting away from arcane rules for passwords. Now you have to avoid every compromised password from any unrelated account? I may use random passwords, but I don't expect the typical consumer to do the same. Sometimes I simply don't care about security for a one off account on a free service where I'll happily use the simplest permutation of "password" for the password.
Re: Prevent users registering with passwords from data breaches
#5This is not a good idea, as implemented. You shouldn't disallow a user from using an otherwise strong password just because it's detected in a breach unless you can definitively see that it's already associated with their email address or username.
The logical conclusion of a password checking system like this is that this password:
ZBjHWJd$8XbJhY7LQvkmARBW)p7xgiDzDw}iMLLw
Re: Prevent users registering with passwords from data breaches
#6This is not a good idea, as implemented. You shouldn't disallow a user from using an otherwise strong password just because it's detected in a breach unless you can definitively see that it's already associated with their email address or username. The logical conclusion of a password checking system like this is that this password: ZBjHWJd$8XbJhY7LQvkmARBW)p7xgiDzDw}iMLLw can no longer be used by anyone, because I'v…
Any known password is no longer a particularly strong one.
Re: Prevent users registering with passwords from data breaches
#7This is not a good idea, as implemented. You shouldn't disallow a user from using an otherwise strong password just because it's detected in a breach unless you can definitively see that it's already associated with their email address or username. The logical conclusion of a password checking system like this is that this password: ZBjHWJd$8XbJhY7LQvkmARBW)p7xgiDzDw}iMLLw can no longer be used by anyone, because I'v…
If they use an already compromised password, they're prone to a dictionary attack.
edit: I did try logging into your account with the password you posted. :P
Re: Prevent users registering with passwords from data breaches
#8This is not a good idea, as implemented. You shouldn't disallow a user from using an otherwise strong password just because it's detected in a breach unless you can definitively see that it's already associated with their email address or username. The logical conclusion of a password checking system like this is that this password: ZBjHWJd$8XbJhY7LQvkmARBW)p7xgiDzDw}iMLLw can no longer be used by anyone, because I'v…
Any known password is no longer a particularly strong one.
That doesn't make sense. If I publish a list of 20 trillion alphanumeric passwords, each of which is 20 characters long, your thesis is that no one should ever use any of those passwords again?
Re: Prevent users registering with passwords from data breaches
#9Earlier quoted context omitted.
Any known password is no longer a particularly strong one.
That doesn't make sense. If I publish a list of 20 trillion alphanumeric passwords, each of which is 20 characters long, your thesis is that no one should ever use any of those passwords again?
If it's published as a list of known passwords, yes. That's roughly 1.50463276905253e-21 percent of the potential passwords for that character space (assuming 64 possible characters). If it's know that those are passwords then they're much much easier to test against than the 1329227995784915872903807060280344576 possibilities.
Re: Prevent users registering with passwords from data breaches
#10This is not a good idea, as implemented. You shouldn't disallow a user from using an otherwise strong password just because it's detected in a breach unless you can definitively see that it's already associated with their email address or username. The logical conclusion of a password checking system like this is that this password: ZBjHWJd$8XbJhY7LQvkmARBW)p7xgiDzDw}iMLLw can no longer be used by anyone, because I'v…
That said, I know of one event where someone got into a bunch of accounts on a site and did some real damage by using known username password combinations and preemptively forcing specifically those accounts to change their passwords and blocking them from being used would have prevented the outcome that the site invalidated literally every user's password instead.