Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

Post reply on HN
Print view View original

11–20 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#11

Post by yarwelp_ »

On the topic of passwords, have a look at my command-line passphrase generation program.

GitHub: https://github.com/ctsrc/pgen

It's written in Rust. Install the Rust toolchain installer from https://rustup.rs/

    curl https://sh.rustup.rs -sSf | sh
And remember to add ~/.cargo/bin to your PATH.

Then install my command-line utility

    cargo install pgen
Usage is described in detail in the README on GitHub. Additionally you can ask the program itself for a brief help summary.

    pgen --help
Eventually pgen will be available in some package manager repos so that you can use your preferred package manager to install pgen but until then it must be built from source following the steps above.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#12

Post by ythn »

roymurdock wrote: post #3

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

Algorithmic password in your head, with a google spreadsheet to keep track of usernames, password rules, etc. on a per site basis (i.e. "bankofamerica, ythn.smith@gmail.com, 4-12 characters - no special).

Edit: downvote away, but so far no one has ever been able to give a compelling reason why algorithmic passwords are bad. It has tradeoffs, sure, but so do password managers.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#13

Post by baxtr »

roymurdock wrote: post #3

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

Actually, I’m pretty happy with the integrated iOS password manager. They also feature app support now. Works like a charm for me

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#14

Post by fiatjaf »

roymurdock wrote: post #3

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

I don't trust myself enough to keep track of a local database of passwords, because of that for years I sticked to the tactic of repeating the same 2~3 passwords over and over on all websites.

Now I'm using https://lesspass.com/, a deterministic password generator that requires no setup besides installing a browser extension[1] and doesn't requires me to keep a database or run any other custom programs.

[1]: There's the official extension for all browsers, but I've developed my own, https://lesspass.alhur.es/, which solves 99% of the problems associated with the whole LessPass idea.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#15

Post by y03a »

roymurdock wrote: post #3

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

Just keep in mind anything simpler likely has additional attack surfaces. e.g. Anything that's cloud based, browser plug-in, centralized, etc. all bring the standard attack surfaces in that domain. Still, it's probably better than what most people do, same user name/password combo everywhere.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#16

Post by chrislomax »

roymurdock wrote: post #3

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

Again, 1Password.

It allows you to login to multiple workspaces so you can have your family plan and your work team plan at the same time.

There is a cost but I can guarantee that it’s saved me more in time than the cost could ever amount to.

I’ve never used an insecure password since using it. All completely random and it’s so easy to use.

The different vaults means I can grant my little boy access to the stuff he uses whilst having my credit card and server details in other vaults without fear that he can access them (more the credit card details). I just need to get the wife into using it now...

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#17

Post by ibdf »

sachleen wrote: post #7
roymurdock wrote: post #3

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

Long time lastpass user recently switched to BitWarden. I find it's UI to be cleaner/easier to use

My biggest frustration with lastpass is that it doesn't seem to know the difference between subdomains, so it suggests several passwords for the same domain even though I am on different subdomains.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#18

Post by dmitrygr »

yarwelp_ wrote: post #11

On the topic of passwords, have a look at my command-line passphrase generation program. GitHub: https://github.com/ctsrc/pgen It's written in Rust. Install the Rust toolchain installer from https://rustup.rs/ curl https://sh.rustup.rs -sSf | sh And remember to add ~/.cargo/bin to your PATH. Then install my command-line utility cargo install pgen Usage is described in detail in the README on GitHub. Additionally you…

A personal question. Do people really install megabytes of dependencies to run what would be a one line shell script, were it written in shell?

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#20

Post by Pxtl »

dmitrygr wrote: post #18
yarwelp_ wrote: post #11

On the topic of passwords, have a look at my command-line passphrase generation program. GitHub: https://github.com/ctsrc/pgen It's written in Rust. Install the Rust toolchain installer from https://rustup.rs/ curl https://sh.rustup.rs -sSf | sh And remember to add ~/.cargo/bin to your PATH. Then install my command-line utility cargo install pgen Usage is described in detail in the README on GitHub. Additionally you…

A personal question. Do people really install megabytes of dependencies to run what would be a one line shell script, were it written in shell?

Mental bandwidth is more expensive than megabytes, so yes.
Post reply on HN