A decade of Have I Been Pwned • Hacker News Board

Re: A decade of Have I Been Pwned

#151

Post by hirsin » Tue, Dec 05, 2023, 6:56 AM UTC

rockskon wrote: post #51

adameasterling wrote: post #19

Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from crede…

About a decade back, I was at an event that had an FBI employee presenting. During his presentation, he had mentioned a story of a sys admin who had been arrested for taking a hashed PW database in his company, comparing the hashes against known compromised one's (perhaps from haveibeenpwned?), and forced a password reset for everyone who had reused a password that had separately been compromised and sent an email to…

I certainly believe it a user was upset by it. We've gotten support tickets before from users accusing of of "snooping on their local machine" to find passwords... Like no, it was just in a breach, relax.

They're often now upset they've been called to task so it's just hard all around.

Re: A decade of Have I Been Pwned

#152

Post by _lvbh » Tue, Dec 05, 2023, 8:39 AM UTC

benced wrote: post #89

Sephr wrote: post #76

I have memories of this site providing me with an excellent experience. Now it's just a cash-grab, asking for $169.50/year just to see 100 breached accounts! I use unique email addresses (breach canaries) on every website to detect when sites leak my data. When I tried to search for my domain results with a previous domain ownership verification, I got hit with this error: "In order to search a domain with any more t…

You’re doing a weird thing (running your own email domain), doing an even weirder thing (using a different address per site), and then doing an even more weirder thing (scanning your personal domain for breaches) and your supposition is that very specific use case is a cash cow for Troy Hunt? Come on.

I do the exact same thing minus the breach scanning. It’s not uncommon.

Re: A decade of Have I Been Pwned

#153

Post by berkes » Tue, Dec 05, 2023, 8:53 AM UTC

twisteriffic wrote: post #144

CoffeeOnWrite wrote: post #63

Earlier quoted context omitted.

> sys admin accessing password hashes placed under his care Parent commenter never mentioned anything about comparing stored password hashes. What you do is block bad passwords at password set time by hashing the prospective password and comparing with HIBP. A prospective password you haven't accepted or stored or transmitted off the application server - common sense says that's not a privacy violation - and many gia…

> Oh yea I remember HIBP has an online API. Don't use this. That's not the greatest advice IMO. The API gets updated data more frequently, doesn't require that you transmit the password or a useable hashed form, and it's dead simple to consume. I'd argue that it's more effort to maintain an internal store and synchronization infrastructure, and you're less likely to accidentally breach anonymity and leak a weak hash…

Those are good arguments for using an online service. But your conclusion is premature and certainly cannot be made blanket like that in favor of using the API.

Just as many arguments can be made for an offline check. Or against an online check. From added latency via required uptime to added dependencies.

My point being: no. "It depends"

Re: A decade of Have I Been Pwned

#154

Post by g_p » Tue, Dec 05, 2023, 9:04 AM UTC

solatic wrote: post #150

adameasterling wrote: post #19

Troy Hunt is such a treasure. And for us web application developers, there is no excuse for not having protection against credential stuffing! While the best defense is likely two-factor [1], checking against Hunt's hashed password database is also very good and requires no extra work for users! I don't have anything to back this up, but my guess is that the vast majority of compromised user accounts comes from crede…

> If you're a young CTO or early-stage engineer working on a web app If you're working on a greenfield login/auth, please don't accept and store passwords in a database! Setup social OAuth, SSO, or magic link emails and make it someone else's problem.

If you do go down this route though, be sure to read up on what you're deploying, and understand what your libraries are doing (and more importantly, not doing).

You don't want to end up with a naive implementation of OAuth2 (like some big names had recently) which fails to check the audience parameter, and therefore lets anyone other service using the same SSO gain access to your users' accounts.

Recent HN post on this - https://news.ycombinator.com/item?id=38009291

Re: A decade of Have I Been Pwned

#155

Post by that_guy_iain » Tue, Dec 05, 2023, 9:09 AM UTC

Denvercoder9 wrote: post #86

santiagobasulto wrote: post #77

Earlier quoted context omitted.

Sorry, I don't understand the procedure. If the database contains hashed passwords (I haven't seen or download the database), how can you know you're using the same salt and method that the one in the datbase? For example, let's say Tumblr was hacked and with it my password `hunter2`. Tumbler used some naive HMAC-MD5 method with a salt, but my site uses argon2 with (obviously) a different salt. Even though my passwor…

The HIBP database only stores hashes of leaked passwords, but the source material is often (always?) plaintext passwords. If the hash of a password is in the HIBP database, the plaintext password is out there somewhere in a database of a malicious actor.

> If the hash of a password is in the HIBP database, the plaintext password is out there somewhere in a database of a malicious actor.

My understanding this isn't true. These leaks are often just the password hashes.

Re: A decade of Have I Been Pwned

#156

Post by barkingcat » Tue, Dec 05, 2023, 9:24 AM UTC

doix wrote: post #149

brianpan wrote: post #88

Earlier quoted context omitted.

Besides legal, I think it's important to realize that there is a very emotional response to discovering that your password is not good. I know a company that started doing quarterly brute-forcing of passwords as a security check and the reaction to finding out that your password is not strong enough is....all sorts of emotions. If you have a 10-12 character password that may have been strong at one point but now is n…

When a 12 character gets bruteforced, my initial reaction is to blame the system for allowing so many password attempts! Like imagine how many failed attempts must've happened for a 12 character password to get bruteforced. Alarms should have been raised way before it became an issue.

what if it was a crappy 12 character password like 123456789012 and got bruteforced in 2 tries?

also, at one point it was popular to use l33t speak for passwords so there are many crappy 12+ char l33t passwords floating around that are trivial to guess, no brute forcing required.

Re: A decade of Have I Been Pwned

#157

Post by rswskg » Tue, Dec 05, 2023, 11:04 AM UTC

dylan604 wrote: post #50

craignatic wrote: post #21

he shouldn't have mentioned goatse, or told me not to google it. my curious brain took me to a rabbit hole where several times i wished i didnt have eyes.

what's the learning curve of a GenZer? When boomer says don't look this up on the internet, it's not because they want the information for themselves. It's because they already have something burned into the memories, and are hoping to save you from the same.

Doesn't look good does it?

Re: A decade of Have I Been Pwned

#158

Post by guenthert » Tue, Dec 05, 2023, 11:05 AM UTC

And this isn't complete and utter bullshit?

My e-mail address (after requiring JS and cookies) was allegedly found in an collection of avatars ...

I'm sure it's now in a collection I rather not have it in.

Re: A decade of Have I Been Pwned

#159

Post by Digit-Al » Tue, Dec 05, 2023, 11:38 AM UTC

that_guy_iain wrote: post #155

Denvercoder9 wrote: post #86

Earlier quoted context omitted.

The HIBP database only stores hashes of leaked passwords, but the source material is often (always?) plaintext passwords. If the hash of a password is in the HIBP database, the plaintext password is out there somewhere in a database of a malicious actor.

> If the hash of a password is in the HIBP database, the plaintext password is out there somewhere in a database of a malicious actor. My understanding this isn't true. These leaks are often just the password hashes.

There are some leaks where passwords are cracked and included in plaintext and there are some leaks where passwords are not cracked and included only as hashes. If the leak includes cracked passwords in plaintext then they will be added to HIBP and can be checked, otherwise they are not included and cannot be checked.

Re: A decade of Have I Been Pwned

#160

Post by blueflow » Tue, Dec 05, 2023, 12:10 PM UTC

tptacek wrote: post #141

Sephr wrote: post #139

Earlier quoted context omitted.

Not yet. Best practices can change.

Best practices have two attributes, both of which represent consensus among practitioners in the field: that it produces an optimal outcome, and that it can reasonably be broadly adopted. Email canaries clearly flunk the second test.

What is preventing you from from adoption?