Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A decade of Have I Been Pwned

troyhunt.com

Post reply on HN
Print view View original

91–100 of 181 posts

Re: A decade of Have I Been Pwned

#91

Post by vasco »

rockskon wrote: post #57
kranke155 wrote: post #55

Earlier quoted context omitted.

I would love to get a proper source on this. Seems a bit crazy, and wouldn't this be thrown out on appeal?

Unfortunately I have no source to give. The FBI employee was just giving an example of illegal behavior he knew of. He didn't cite jurisdiction or the names of people involved. Hell - even if he did, I likely wouldn't have remembered it as this was roughly 8 years ago I was in the audience for this (I know I said roughly a decade ago in my prior post - but I checked a receipt for the event and it was in 2015).

Really hard to belief without anything else to go by. This sounds like old wives tales like people that add disclaimers saying they aren't laywers when they comment on the internet because someone once told them they heard someone got in trouble.

Re: A decade of Have I Been Pwned

#92

Post by cheschire »

dotancohen wrote: post #90
benced wrote: post #89

Earlier quoted context omitted.

You’re doing a weird thing (running your own email domain), doing an even weirder thing (using a different address per site), and then doing an even more weirder thing (scanning your personal domain for breaches) and your supposition is that very specific use case is a cash cow for Troy Hunt? Come on.

I do the exact same thing. Every site, service, and contact gets a personal something@mydomain email address to reach me.

Somewhere in the distance, the Count from Sesame Street says "TWO... ah ah ah..."

Re: A decade of Have I Been Pwned

#93

Post by santiagobasulto »

adameasterling wrote: post #87
santiagobasulto wrote: post #81

Earlier quoted context omitted.

Yes, exactly, so that's why I was asking, you mentioned the database was of hashed passwords. The database then contains the source passwords? And you're preventing the user from using one of those passwords? Sorry, I still don't understand the procedure you mentioned and I'm genuinely curious.

Oh, I see the issue. The HIBP database is SHA-1 hashed with no salt. It was created from unhashed passwords. You can't download the unhashed version (you could of course compute it, if you really wanted to; but there's no need). So, the procedure you need to implement is, on login/registration/pw reset, you SHA-1 hash the user's unhashed password and do a indexed lookup on your copy of HIBP's database. Or if you don'…

Ah! Thanks a lot, it now makes sense. So at some point HIBP has the unhashed passwords, they obviously don’t make those public, good trick. How do you handle this from a UX perspective? Just tell the user that password is “not strong enough”?

Re: A decade of Have I Been Pwned

#94

Post by Sephr »

benced wrote: post #89
Sephr wrote: post #76

I have memories of this site providing me with an excellent experience. Now it's just a cash-grab, asking for $169.50/year just to see 100 breached accounts! I use unique email addresses (breach canaries) on every website to detect when sites leak my data. When I tried to search for my domain results with a previous domain ownership verification, I got hit with this error: "In order to search a domain with any more t…

You’re doing a weird thing (running your own email domain), doing an even weirder thing (using a different address per site), and then doing an even more weirder thing (scanning your personal domain for breaches) and your supposition is that very specific use case is a cash cow for Troy Hunt? Come on.

I said cash-grab, not cash cow. A cash grab is something that has an unreasonably high profit margin. A cash cow is something that provides a significant portion of an entity's income.

I have no idea if HIBP is a cash cow for Troy. It may be, given these prices, but I don't know much about his other sources of income.

HIBP didn't start out as a cash-grab, but it is one now. Troy could have chosen to price it reasonably to cover the costs of the service. This pricing is clearly taking advantage of HIBP's popularity as the de-facto breach list site.

Re: A decade of Have I Been Pwned

#95

Post by cqqxo4zV46cp »

cedilla wrote: post #80
LeifCarrotson wrote: post #38

Earlier quoted context omitted.

> ... and then realize with a horrible feeling that some % of those hits are getting through the login page. The alternative is the exact same scenario, except that the percentage is several orders of magnitude lower, right? The small subset of your users that explicitly opted-out of 2-factor authentication (if you allow that) and who try to choose "Password1!" with a second exclamation point when your site said "Err…

Wait, a thousand fold decrease is not worth it? Your numbers literally turns a scenario where 200,000 accounts are hacked into one where 200 are exposed. Or one where 30 hacked accounts turn into 0 hacked accounts. There is a point where a difference in quantity becomes a difference in quality. I far prefer the latter scenarios.

Anybody (like GP) that doesn’t understand that this is entirely the nature of security work, should not be making any material decisions about security.

The number of times I’ve seen DEVELOPERS neglect to implement materially useful security measures because “they’re not technically perfect!” Is astounding.

Re: A decade of Have I Been Pwned

#96

Post by bigstrat2003 »

craignatic wrote: post #21

he shouldn't have mentioned goatse, or told me not to google it. my curious brain took me to a rabbit hole where several times i wished i didnt have eyes.

You get kind of immune to it eventually. At this point I don't even get fazed by goatse, if anything I'm more impressed by just how far that guy managed to stretch.

Re: A decade of Have I Been Pwned

#97

Post by cqqxo4zV46cp »

KolmogorovComp wrote: post #74
adameasterling wrote: post #19

Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from crede…

> ... and then realize with a horrible feeling that some % of those hits are getting through the login page. (Non sarcastic), why would you feel bad for users using 1234 as their passwords? Unless your website is aimed at vulnerable people, I consider this to be their responsibility. As other comments have said these users will probably go the easiest route (1234websitename) to fix the error. Any restriction you put…

Because anyone that has ever been responsible for anything knows that there’s a difference between something being your fault and something being your problem.

Breach notification etc legislation in some jurisdictions will also require that you report successful widespread credential stuffing.

Even AWS with their “shared responsibility model” works with GitHub etc to ensure that programmatic access credentials aren’t accidentally exposed via public repositories. This isn’t credential stuffing, but it’s a blindingly accurate demonstration of the fact that drawing a line in the sand and saying “users, work it out from here!” and attempting to wash your hands of the situation is nothing more than the ill-informed pipe dream of someone that’s never had to deal with this stuff in reality.

Re: A decade of Have I Been Pwned

#98

Post by cqqxo4zV46cp »

dotancohen wrote: post #90
benced wrote: post #89

Earlier quoted context omitted.

You’re doing a weird thing (running your own email domain), doing an even weirder thing (using a different address per site), and then doing an even more weirder thing (scanning your personal domain for breaches) and your supposition is that very specific use case is a cash cow for Troy Hunt? Come on.

I do the exact same thing. Every site, service, and contact gets a personal something@mydomain email address to reach me.

[flagged]

Re: A decade of Have I Been Pwned

#99

Post by lainga »

lainga wrote: post #11
gumby wrote: post #8

Earlier quoted context omitted.

> haveibeenfucked.com Years ago we had friends, a couple in which the wife was pregnant. They were actually a bit embarrassed that “everyone will know that we ‘did it’”. A level of squeamishishness I could not have imagined!

Haha, yes, for the same reason it used to be rude to ask "when are you expecting?", especially if newly married

(too late to edit...) P.S. Not in the sense of "when will you have a baby", in the sense of "was the baby conceived before the marriage"

Re: A decade of Have I Been Pwned

#100

Post by stuckkeys »

rockskon wrote: post #51
adameasterling wrote: post #19

Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from crede…

About a decade back, I was at an event that had an FBI employee presenting. During his presentation, he had mentioned a story of a sys admin who had been arrested for taking a hashed PW database in his company, comparing the hashes against known compromised one's (perhaps from haveibeenpwned?), and forced a password reset for everyone who had reused a password that had separately been compromised and sent an email to…

Hmm. Interesting. Shitty outcome if true, but AD/Azure AD has an extension (3rd party if I recall) that automatically checks for breached passwords and lets the user know and forces them to change their password.
Post reply on HN