111–120 of 184 posts
Earlier quoted context omitted.
test the SHA1 of your passwords, not your passwords, and you are safe.
A weak password can still be cracked given the sha1 hash and a dictionary.
Also, I'm genuinely curious as to why SHA-1 is used and not SHA-256. Surely the one-time additional cost of using SHA-256 would've been negligible for Troy? If at some point somebody manages to do preimage attacks on SHA-1, I have to assume my password is broken if I've submitted its hash to his API. Although I guess you'd have to actually be able to enumerate preimages, preferably from small to big. Still, I don't understand why Troy doesn't account for the possibility by using a hash function widely considered to be stronger.
>If a password is not found in the Pwned Passwords set, it'll result in a response like this: Wait, so I test my password to see if it's "good" and now you have a copy of a password I will be using. Am I just being paranoid?
You can post the sha1sum instead. $ sha1sum SooperSekretPassw0rd^D SooperSekretPassw0rddc0d3504b259a92dce59b850969601d12c06a75f -
$password = "foobar"
([Security.Cryptography.SHA1CryptoServiceProvider]::Create().ComputeHash([Text.Encoding]::ASCII.GetBytes($password)) | %{'{0:x2}' -f $_}) -join ""
Earlier quoted context omitted.
Email address is stupid, we should have randomly generated proxy email addresses.
A former coworker makes liberal use of American Express disposable credit card numbers -- proxy credit card numbers that you can request to give away to less than trustworthy merchants.
Earlier quoted context omitted.
A former coworker makes liberal use of American Express disposable credit card numbers -- proxy credit card numbers that you can request to give away to less than trustworthy merchants.
Privacy ( https://privacy.com/ ) offers a similar service for those that want something that works with more than American Express cards or other such offerings from other card issuers.
Earlier quoted context omitted.
KeePass uses an auto-type feature; wouldn't that simulate individual key presses, and defeat anti-paste mechanisms?
I find that on some sites if I click in the username field and alt tab to keepass or any other function I'm suddenly not in the txt field on the site... thus I can't trigger auto type at times.
I then entered {DELAY 3000}{PASSWORD}
Now I can log in to a full screen game that doesn't allow pasting (I type in the username by hand first). If I'm alt-tabbed out of the game with KeePass in focus, the three second delay is enough time to go from triggering auto-type to restoring the full screen game window and clicking on the password field to give it focus. I was unable to trigger KeePass autotype with the game already full screen.
If the account you're trying to log in to also has a long random username that needs to be auto-typed, you'll probably want a sequence like "{DELAY 3000}{USERNAME}{TAB}{PASSWORD}". Or, if the form doesn't allow you to tab from the username to the password field, you could use "{DELAY 3000}{USERNAME}{DELAY 3000}{PASSWORD}" and you can click on the password field during the second delay.
For example, if I have a site that requires passwords to be at least 10 chars long, I don't need any of the data for breached passwords that are shorter than 10 characters. People can't possibly use them anyway, so that's probably a huge chunk of the data that's completely useless to be storing and checking.
Earlier quoted context omitted.
I believe the idea is to ensure no one can use the listing to brute force.
I think gp is complaining that the second you type your password into the form, you've "used it", hence you should change it. The gp makes a good point, but that's also why you can submit the `sha1($your_password)` instead. The only question is why did Troy allow un-hashed passwords to be submitted.
I mean, here is the SHA1 of my password (not really):
d012f68144ed0f121d3cc330a17eec528c2e7d59
This site:
https://hashkiller.co.uk/sha1-decrypter.aspx
>We have a total of just over 312.072 billion unique decrypted SHA1 hashes since August 2007.
Took exactly 221 ms to reverse it to "pippo".
Earlier quoted context omitted.
You can post the sha1sum instead. $ sha1sum SooperSekretPassw0rd^D SooperSekretPassw0rddc0d3504b259a92dce59b850969601d12c06a75f -
If you're on Windows, you can calculate it in PowerShell like this: $password = "foobar" ([Security.Cryptography.SHA1CryptoServiceProvider]::Create().ComputeHash([Text.Encoding]::ASCII.GetBytes($password)) | %{'{0:x2}' -f $_}) -join ""