Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Have I Been Pwned 2.0

troyhunt.com

Post reply on HN
Print view View original

281–290 of 323 posts

Re: Have I Been Pwned 2.0

#281

Post by ben0x539 »

Aachen wrote: post #202

> It's likely a single-digit percentage of requests that are real humans being [blocked], and we need to look at ways to get that number down, but at least the fallback positions are improved now. The fallback suggestions mentioned in the article are "try clicking the box again" and "try reloading the page" I'm slowly starting to wonder if I should start sending snail mail to companies that block me, instead of resig…

I got "radicalized" about these filter measures at my last job, where we operated a popular public-facing website, and we apparently adopted some third-party solution to reject otherwise valid logins based on some heuristics, with an intentionally vague "try again later"-style error message. Throughout a few months, I noticed a steady trickle of coworkers talking on the internal chat about being unable to log into the site citing that exact error, with varying degrees of urgency (eg. for myself, I noticed I couldn't log in using a private browsing window, but didn't worry too much because my long-lived session cookies were still fine). I like to think all of them were eventually pointed in the direction of the team working on the integration so that these false positives could be worked around, but definitely not everybody initially realized what was happening to them.

If even people within the same company fell victim to these filters, what chance would the wider public have? On the other side of my tenuous work/life balance, multiple friends that were long-time users of our product were also getting locked out of the site, and of course they had no means of understanding that they were false positives of a fraud detection heuristic, much less of getting individualized support. I know those people and that they were genuine good-faith users, but naturally, while I could pass on word of their struggle, I couldn't offer any actual help since that would disclose details about those heuristics that we were apparently paying good money for and wouldn't want the public to know anything about. I also saw social media discussions where other affected users were helplessly telling each other to try different browsers or reinstall Windows.

Of course, I understand the need to combat abuse of services (and I applaud this employer for many other measures taken in that effort), but it definitely did a number on my loyalty to the company and excitement to be part of the industry to realize that my friends and I would be readily sacrificed if push came to shove.

Re: Have I Been Pwned 2.0

#282

Post by johnisgood »

mulmen wrote: post #240
xythobuz wrote: post #206

Earlier quoted context omitted.

Then these people _obviously_ are not fit to drive a multi-ton killing machine at all and should have their license permanently revoked, when they had multiple chances for introspection.

And yet people drive with suspended licenses every day.

Yeah, as if "criminals" cared about the laws. :D (See: gun control).

Re: Have I Been Pwned 2.0

#283

Post by qingcharles »

AdamH12113 wrote: post #9

Amazing that even within the last decade a site as large as LinkedIn could be storing unsalted passwords. How does anyone fail at this in the modern era?

I worked for a company with millions of users that had plaintext passwords in the DB. The login had been rolled from scratch in the days before you could get decent, tested off-the-shelf code for their particular stack. There were always so many fires to put out and projects to keep the wages being paid that it never got looked at. It got bought by Microsoft and eventually they just consumed the whole thing somehow, so it's gone now.

It did allow me to cheekily run a SQL GROUP BY once to see what the most common passwords were, though. Top password was actually "trustno1" IIRC, followed by all the usual suspects, e.g. abcdefg, 12345678 etc. (there were no meaningful password rules)

Re: Have I Been Pwned 2.0

#284

Post by MattSteelblade »

atonse wrote: post #265
MattSteelblade wrote: post #222

Earlier quoted context omitted.

Open-source versus proprietary and the option to self-host are the two that immediately come to mind.

I can't speak about the other password managers, but 1Password's architecture ensures even 1Password can't see any of your credentials. It's E2E Encrypted. I've been a 1Password user for over a decade. It's user friendly, and I'd rather not have the responsibility to self-host my company and extended family's credentials.

Bitwarden is also a zero knowledge architecture built on E2EE; I would presume that is the standard in the industry.

Re: Have I Been Pwned 2.0

#285

Post by EasyMark »

brightball wrote: post #226

Does it feel like this site is itself a vulnerability? It seems like being able to go type in anybody's email address and just get a list of sites where it was found would be part of an OSINT process. Shouldn't it at least send you a link to verify that you control the address before showing your results?

Most online criminals will already have this or know how to get it with even the slightest bit of research, so it's not really a big deal in 99% of the cases. I think the net good is better than the net bad by orders of magnitude.

Re: Have I Been Pwned 2.0

#286

Post by newZWhoDis »

devmor wrote: post #254
uncletammy wrote: post #250

Earlier quoted context omitted.

How does the EU solution make user's whole? At least with class actions, users get to see a few pennies. I'm not trying to make an argument against strong regulatory bodies. We need those for sure. It would just be nice if the users were compensated for the exploitation and abuse they're subjected to.

The US solution does not make users whole and does not meaningfully change anything. The EU solution meaningfully changes the offending company's behavior. I would rather have significantly less breaches of my information than a check for $6 in the mail every couple months.

>The EU solution meaningfully changes the offending company's behavior

How are those cookie consent popups working out?

Re: Have I Been Pwned 2.0

#287

Post by tatersolid »

stouset wrote: post #162
taberiand wrote: post #126

Earlier quoted context omitted.

Would this be solved by providing the client with a (frequently rotated) public key to encrypt the password field specifically before submitting to the server, so that the only place it can be decrypted and stored is the authentication service at the very end of its journey through the network?

The existing solution for this is SRP (Secure Remote Passwords http://srp.stanford.edu/ ). Unfortunately my understanding is that it’s trivial to implement unsoundly but it’s also not something for which there are an abundance of good implementations across languages. It’s been awhile since I’ve looked though so maybe there is a newer, less radioactive approach. But yes, never actually sending the authenticator itsel…

SRP, even the latest version, is unfortunately pretty bad in comparison to modern PAKE protocols: https://blog.cryptographyengineering.com/should-you-use-srp/

Re: Have I Been Pwned 2.0

#288

Post by devmor »

newZWhoDis wrote: post #286
devmor wrote: post #254

Earlier quoted context omitted.

The US solution does not make users whole and does not meaningfully change anything. The EU solution meaningfully changes the offending company's behavior. I would rather have significantly less breaches of my information than a check for $6 in the mail every couple months.

>The EU solution meaningfully changes the offending company's behavior How are those cookie consent popups working out?

It is a meaningful change, or you wouldn’t be talking about it.

Meaningful does not mean a solution.

Re: Have I Been Pwned 2.0

#289

Post by freedomben »

meroes wrote: post #272
freedomben wrote: post #266

Earlier quoted context omitted.

Ah yes, automated lawsuit initiation, that's what we need! Ooh, we could run every breach announcement through Deep Research and let the AI make a determination on which one is negligence! That would definitely incentivize more transparency and accountability on behalf of companies! Actually no, the end result of this will be a return to deny, deny, deny, because the worst case scenario then becomes the truth getting…

Look at this recent “data incident” https://oag.ca.gov/system/files/Partnership%20HealthPlan%20o... “Based on the investigation into this incident, it was determined that the information involved may include your name, Social Security number, date of birth, Driver’s License number (if provided), Tribal ID number (if provided), medical record number, treatment, diagnosis, prescription and other medical information, he…

I guess I should clarify: for incidents like that, I agree there should be severe consequences and blowback, including class action lawsuits and the like. If you are collecting stuff like SSN, DoB, DL number, etc then you definitely have a huge responsibility to protect that. I want to make data like that radioactive to collect so people think very carefully about whether they want to take on the liability.

What I don't think should happen is some automated lawyer combing the internet looking for any disclosures and then automatically filing lawsuits based on it.

Re: Have I Been Pwned 2.0

#290

Post by greycol »

newZWhoDis wrote: post #286
devmor wrote: post #254

Earlier quoted context omitted.

The US solution does not make users whole and does not meaningfully change anything. The EU solution meaningfully changes the offending company's behavior. I would rather have significantly less breaches of my information than a check for $6 in the mail every couple months.

>The EU solution meaningfully changes the offending company's behavior How are those cookie consent popups working out?

Great, they meant better acting corporations have no click or single click (dismiss-able with simple add-ons to proactively affirm the user's position) ribbons to get get rid of unwanted cookies. Let's be realistic anyone who hates those banners and hasn't bothered to do the google search and 5 minute task to get rid of them permanently (either enabling or disabling consent) is not having their political opinion changed by them, they are using them as an excuse to buttress their position of government bad or corporations malicious.
Post reply on HN