A decade of Have I Been Pwned • Hacker News Board

Re: A decade of Have I Been Pwned

#51

Post by rockskon » Mon, Dec 04, 2023, 8:06 PM UTC

adameasterling wrote: post #19

Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from crede…

About a decade back, I was at an event that had an FBI employee presenting. During his presentation, he had mentioned a story of a sys admin who had been arrested for taking a hashed PW database in his company, comparing the hashes against known compromised one's (perhaps from haveibeenpwned?), and forced a password reset for everyone who had reused a password that had separately been compromised and sent an email to each employee explaining this.

One of the employees was apoplectic at the actions of the sys admin and had accused him of violating her privacy by doing this. While I do not recall which party initiated legal action against the sys admin that led to his arrest (i.e. the employee or the company), the bottom line of the story was that the FBI employee (and, by extention, whichever judge was involved in adjudication the case) considered the act of a sys admin accessing password hashes placed under his care to be a criminal breach of privacy regardless of his intent being to improve his company's security against password stuffing attacks.

Assuming the FBI employee didn't just make the whole thing up (which I have no reason to believe - there are a lot of tech-stupid judges and, especially a decade ago, tech-stupid FBI employees), it might be prudent to pass this by your legal team before checking for password hashes for your employees being in haveibeenpwned.

Re: A decade of Have I Been Pwned

#52

Post by prepend » Mon, Dec 04, 2023, 8:10 PM UTC

toomuchtodo wrote: post #36

prepend wrote: post #35

Earlier quoted context omitted.

People using passkeys are the outlier too.

Google (top site for internet traffic) is defaulting to Passkeys: https://blog.google/technology/safety-security/passkeys-defa... (Gmail has over 1.8 billion active users as of 2023; 22.22% of the world's population uses Google's mail service, so this is material for Passkey uptake) Amazon: https://www.aboutamazon.com/news/retail/amazon-passwordless-... Uber: https://help.uber.com/riders/article/using-passkeys-to-sig…

These stats are supports passkeys, not how many users use them.

I like passkeys, they’re nice.

But I think you want to compare passkey users to complex password users.

I know lots of “normies” and they all just accept whatever their iPhone does. Which is creates a high entropy unique password for each site.

Re: A decade of Have I Been Pwned

#53

Post by incahoots » Mon, Dec 04, 2023, 8:12 PM UTC

rockskon wrote: post #51

adameasterling wrote: post #19

Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from crede…

About a decade back, I was at an event that had an FBI employee presenting. During his presentation, he had mentioned a story of a sys admin who had been arrested for taking a hashed PW database in his company, comparing the hashes against known compromised one's (perhaps from haveibeenpwned?), and forced a password reset for everyone who had reused a password that had separately been compromised and sent an email to…

Well this unlocked a new fear I didn't know I needed to have. I suppose this is the massive drawback to allowing dinosaurs to spearhead policy and govern laws.

Re: A decade of Have I Been Pwned

#54

Post by jimmySixDOF » Mon, Dec 04, 2023, 8:16 PM UTC

IsoldesKnight wrote: post #28

craignatic wrote: post #21

he shouldn't have mentioned goatse, or told me not to google it. my curious brain took me to a rabbit hole where several times i wished i didnt have eyes.

Let me be the one to tell you not to look up tubgirl or meatspin. The turn-of-the millennium internet was a dirty place.

too true and for some reason there was a rule like the worse the content the faster it would download/torrent/kazaa/limewire/etc lol

Re: A decade of Have I Been Pwned

#55

Post by kranke155 » Mon, Dec 04, 2023, 8:24 PM UTC

rockskon wrote: post #51

adameasterling wrote: post #19

Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from crede…

About a decade back, I was at an event that had an FBI employee presenting. During his presentation, he had mentioned a story of a sys admin who had been arrested for taking a hashed PW database in his company, comparing the hashes against known compromised one's (perhaps from haveibeenpwned?), and forced a password reset for everyone who had reused a password that had separately been compromised and sent an email to…

I would love to get a proper source on this. Seems a bit crazy, and wouldn't this be thrown out on appeal?

Re: A decade of Have I Been Pwned

#56

Post by sunnybeetroot » Mon, Dec 04, 2023, 8:42 PM UTC

ziddoap wrote: post #6

moose44 wrote: post #4

For those privacy focused, here's how you can remove your information from their public search ability. https://haveibeenpwned.com/OptOut

Seems slightly useless to opt-out of HIBP when your email is still in Collection #1 or Anti Public Combo List or whatever. Anyone wanting to do something nefarious with the emails will surely download the full source lists rather than try and scrape the aggregation site.

Wouldn’t it be hashed?

Re: A decade of Have I Been Pwned

#57

Post by rockskon » Mon, Dec 04, 2023, 8:45 PM UTC

kranke155 wrote: post #55

rockskon wrote: post #51

Earlier quoted context omitted.

About a decade back, I was at an event that had an FBI employee presenting. During his presentation, he had mentioned a story of a sys admin who had been arrested for taking a hashed PW database in his company, comparing the hashes against known compromised one's (perhaps from haveibeenpwned?), and forced a password reset for everyone who had reused a password that had separately been compromised and sent an email to…

I would love to get a proper source on this. Seems a bit crazy, and wouldn't this be thrown out on appeal?

Unfortunately I have no source to give. The FBI employee was just giving an example of illegal behavior he knew of. He didn't cite jurisdiction or the names of people involved. Hell - even if he did, I likely wouldn't have remembered it as this was roughly 8 years ago I was in the audience for this (I know I said roughly a decade ago in my prior post - but I checked a receipt for the event and it was in 2015).

Re: A decade of Have I Been Pwned

#58

Post by TacticalCoder » Mon, Dec 04, 2023, 8:45 PM UTC

rockskon wrote: post #51

adameasterling wrote: post #19

Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from crede…

About a decade back, I was at an event that had an FBI employee presenting. During his presentation, he had mentioned a story of a sys admin who had been arrested for taking a hashed PW database in his company, comparing the hashes against known compromised one's (perhaps from haveibeenpwned?), and forced a password reset for everyone who had reused a password that had separately been compromised and sent an email to…

Accessing password hashes already in a DB is not the same as preventing, during account creation, the reuse of a password known to be compromised.

If I'm not mistaken it's all done using cryptographic schemes that leak neither the password nor the hash.

Re: A decade of Have I Been Pwned

#59

Post by adameasterling » Mon, Dec 04, 2023, 8:45 PM UTC

rockskon wrote: post #51

adameasterling wrote: post #19

Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from crede…

About a decade back, I was at an event that had an FBI employee presenting. During his presentation, he had mentioned a story of a sys admin who had been arrested for taking a hashed PW database in his company, comparing the hashes against known compromised one's (perhaps from haveibeenpwned?), and forced a password reset for everyone who had reused a password that had separately been compromised and sent an email to…

The FBI feeds data into Troy Hunt's database and FBI Director Christopher Wray gave Troy Hunt a medal for his work [1].

The Open Web Application Security Project's Application Security Verification Standard recommends that you do a hashed password check [2].

For bigger companies, sure, go talk to legal, but for young startups, my feeling is it's not worth the $200 or whatever your counsel will charge to say it's ok. I personally did not ask anyone (am cto), I just added the check.

1. https://twitter.com/troyhunt/status/1674132801837477888

2. See OWASP ASVS 4.0 2.1.7 https://github.com/OWASP/ASVS/blob/master/4.0/en/0x11-V2-Aut...

Re: A decade of Have I Been Pwned

#60

Post by virtue3 » Mon, Dec 04, 2023, 8:46 PM UTC

kranke155 wrote: post #55

rockskon wrote: post #51

Earlier quoted context omitted.

About a decade back, I was at an event that had an FBI employee presenting. During his presentation, he had mentioned a story of a sys admin who had been arrested for taking a hashed PW database in his company, comparing the hashes against known compromised one's (perhaps from haveibeenpwned?), and forced a password reset for everyone who had reused a password that had separately been compromised and sent an email to…

I would love to get a proper source on this. Seems a bit crazy, and wouldn't this be thrown out on appeal?

Jobs can ask if you have ever been arrested outside of CA. (Note: not convicted of a crime).

Also you are going to spend a long time being arrested before the appeal goes out.

"In California, a criminal appeal can take several months to several years. The length of time depends on the complexity of the case and how quickly it moves through the appeals process."