Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Am Releasing Ten Million Passwords

xato.net

Post reply on HN
Print view View original

121–130 of 229 posts

Re: I Am Releasing Ten Million Passwords

#121

Post by pbreit »

m8urn wrote: post #72
meowface wrote: post #61

Earlier quoted context omitted.

I feel like most of those research questions could be answered if it was a "username -> password strength" mapping, in addition to a hash to study duplicate trends, rather than just "username -> password". Obviously there is no objective ranking of "password strength", but a decent approximation could be provided. There are serious risks to having your username and password in a public list. Yes, all of these usernam…

As I explained in the article I seriously doubt that any more than a tiny number of these passwords are still valid. And there is no reason for them to be, having already been widely available, indexed (and cached) by every search engine, archived at archive.org, and downloaded by thousands or tens of thousands of people. Anyone who would use this data maliciously probably already has it. Much of this data is the sam…

OK, I'll bite: can you give us some ideas on how this would lead to a genuine advancement in user authentication (that we wouldn't have with username/pw de-linked)?

Re: I Am Releasing Ten Million Passwords

#122

Post by pbreit »

bikamonki wrote: post #54

It seems very useful for research and also practical uses, like how about a REST API with this dump? get will not only return true if it exists but how common and how weak it is, or will return a false for unique. Is there such a service out there?

How is that even slightly useful?

Re: I Am Releasing Ten Million Passwords

#123

Post by pbreit »

m8urn wrote: post #41
dj-wonk wrote: post #28

Forgive me for doing so, but allow me to ask some possibly ignorant questions and perhaps play the devil's advocate for a moment. What about this release will help? What are the compelling research problems in the space? We know users pick bad passwords. It seems to me the most compelling "problem" is hardly a research question -- isn't it about finding ways to encourage users pick strong passwords, not share them be…

The main reason I have always included usernames and passwords in my research is because it allows me to analyze frequency data across multiple sites. Although I could have anonymized the usernames, I thought it would be best to keep them in. There is good value there. For example, there is quite a bit of overlap between usernames and passwords. Also, how many users include all or part of their usernames in their pas…

So how would you utilize such knowledge in the real world?

Re: I Am Releasing Ten Million Passwords

#124

Post by dsrguru »

tptacek wrote: post #78
Slartibreakfast wrote: post #69

Earlier quoted context omitted.

I don't know, sounds like he got off pretty lightly considering he threatened an FBI agent's children. I would expect the jail time would be a lot higher, but I guess I don't know what guides the court's decisions in these kinds of cases. I suppose five is enough time for him to figure out the error of his ways.

His sentence was dominated by the accessory charge, and the threats don't seem to have been a factor at all.

The threats actually accounted for 48 of the 63 months according to the EFF article that the OP linked to.

https://www.eff.org/deeplinks/2015/01/eff-statement-barrett-...

Re: I Am Releasing Ten Million Passwords

#125

Post by eurleif »

jbapple wrote: post #116
jbapple wrote: post #114

Earlier quoted context omitted.

What were the threats against the agent and the agent's children? I'm asking because I read some of them ("ruin his life", "look into" his kids), but I'm not sure which of those are protected under the First Amendment. Broad categories of rude speech are protected under the First Amendment, including things like, IIRC: 1. Saying if President Johnson makes you pick up a gun, he'll be the first in your rifle sight. (Wa…

It was "White son of a bitch, I'll kill you", and it was Gooding v. Wilson.

And as far as I can tell, it wasn't that what he said was constitutionally protected. It's that the statute he was charged under was unconstitutionally broad, because it prohibited "abusive language" in general. A more specific statute, prohibiting only threats, would have likely been ruled constitutional.

Re: I Am Releasing Ten Million Passwords

#126

Post by tptacek »

dsrguru wrote: post #124
tptacek wrote: post #78

Earlier quoted context omitted.

His sentence was dominated by the accessory charge, and the threats don't seem to have been a factor at all.

The threats actually accounted for 48 of the 63 months according to the EFF article that the OP linked to. https://www.eff.org/deeplinks/2015/01/eff-statement-barrett-...

EFF's reporting appears to be contradicted by the (now public) sentencing memo. Orin Kerr analyzed it at length for WaPo a few days ago.

Re: I Am Releasing Ten Million Passwords

#127

Post by presumeaway »

meowface wrote: post #27

I don't understand exactly why it's necessary to release usernames along with the passwords, or why it's ethical to do so. Stripping the domain portion of email addresses does absolutely nothing when you can find the real email, and other accounts of the victim, by Googling the unique part of the email address. How does tying each password to its corresponding username help with password research, and does the value…

> I'm struggling to understand the intent here.

A desire for a particular type of attention his ego seems to need.

Which, combined with either a moronic lack of appreciation for the hassle and damage he's going to cause to end-users who've already been hosed once before, or an arrogance that makes him not care, makes him difficult to fit for a white hat.

FTA:

> This is completely absurd that I have to write an entire article justifying the release of this data out of fear of prosecution

What's absurd is his assumption that stripping domain names is somehow sufficient.

Edit: I'm getting downvoted like crazy here. Which is fine, but people seem to think it's ad hominem because I'm narrowing the reasons behind why someone would release a data set with a considerable price of collateral damage attached to it, while doing very little to mitigate that damage.

Just because the likely options for why someone would do such a thing don't speak favorably of the person, doesn't make it ad hominem. An ad hominem attack is seeking to undermine someone's argument by attacking their character.

I'm saying Mark Burnett made it difficult to assume good things about him after a stunt like that. If he actually made a real argument that what he did was sufficient, or that the harm he's going to cause is more than offset by the greater good it'll do (or some such argument), then we'd have something to try to undermine (whether legitimately or fallaciously), but as it stands, he hasn't even justified his actions.

Re: I Am Releasing Ten Million Passwords

#128

Post by ternaryoperator »

nyolfen wrote: post #112
gayprogrammer wrote: post #103

Woah you are REALLY optimistic about law enforcement agencies wanting to focus on real criminals. But Barrett Brown is not the first or only example. Aaron Swartz is the only example I need to understand what to expect from the various US law enforcement agencies.

it's kind of hilarious that it takes a case as transparently self-serving as aaron swartz to calcify a population as privileged and inured to the justice system as programmers to go "woah hey this shit might be kind of fucked up!!!"

Aaron S. was not at all the first time programmers recognized the problem and acted on it. Perhaps it was the first time that you became aware of the issue. But there were large-scale campaigns as far back as Robert Morris's worm in 1988. Even then, programmers were rightly concerned with unfair punishment for hacking and were outspoken about their concern. Similarly, with the Randal Schwartz in 1995, and many times since.

Re: I Am Releasing Ten Million Passwords

#129

Post by jbapple »

eurleif wrote: post #125
jbapple wrote: post #116

Earlier quoted context omitted.

It was "White son of a bitch, I'll kill you", and it was Gooding v. Wilson.

And as far as I can tell, it wasn't that what he said was constitutionally protected. It's that the statute he was charged under was unconstitutionally broad, because it prohibited "abusive language" in general. A more specific statute, prohibiting only threats, would have likely been ruled constitutional.

I'm not sure about "likely", but upon a closer reading, I agree that the Gooding decision looks like it was mainly about the broadness of the statute. Thanks for noting that.

Re: I Am Releasing Ten Million Passwords

#130

Post by MarkMc »

handsomeransoms wrote: post #101
MarkMc wrote: post #97

Earlier quoted context omitted.

For sensitive sites, my preferred solution to this problem is to add a sequence of random characters to the User ID field. The user would then authenticate with something like this: User ID: John-CPE4E38J Password: snoopy For extra security the code would then move the random characters to the password so the authentication library would see this: User ID: John Password: snoopy-CPE4E38J In this way even an attacker w…

Are you generating the User ID with the additional characters and expecting the user to remember/keep track of it? I do think that is very user-friendly, even with the cookie trick you describe. It seems like you are trying to force your user to remember a salt. Why not just use a proper salt and a strong password hashing function? Also note that this protection is only useful in the case where an attacker can get a…

> It seems like you are trying to force your user to remember a salt.

Yes, essentially I'm trying to force the user to remember a client-side 'salt'.

> Why not just use a proper salt and a strong password hashing function?

Because it wouldn't protect against the attack described by userbinator (ie. 'just trying these 20 passwords gives you a ~18% success rate for any username'). Having a client-side 'salt' gives you that protection.

> I do [not] think that is very user-friendly, even with the cookie trick you describe.

Yes, this system imposes a cost in terms of user-friendliness. But for sensitive sites (eg. medical or financial) I think it's worth it.

Post reply on HN