Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

Post reply on HN
Print view View original

131–140 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#131

Post by outworlder »

giarc wrote: post #126
anitil wrote: post #113

Earlier quoted context omitted.

As a policy Troy Hunt won't reveal which breach he found your data in. I considered setting up a series of 'canary' emails so that I could track who's selling what but ... well never got round to it.

You used to be able to adjust your email address to check. For example if you email was bill@gmail.com, you could sign up for HN with bill+hackernews@gmail.com. Gmail ignores the part after the + sign. Therefore if you noticed emails coming to that address, you would know that HN sold their list. However, I've found that most forms reject that as a non-valid email address now.

Yes. Those forms are also ignoring relevant RFCs.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#132

Post by newman8r »

Bromskloss wrote: post #128
anitil wrote: post #113

Earlier quoted context omitted.

As a policy Troy Hunt won't reveal which breach he found your data in. I considered setting up a series of 'canary' emails so that I could track who's selling what but ... well never got round to it.

How does he get hold of the data in the first place?

not sure what his methods are, but you can find torrents of most of the dumps

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#134

Post by [deleted] »

giarc wrote: post #126
anitil wrote: post #113

Earlier quoted context omitted.

As a policy Troy Hunt won't reveal which breach he found your data in. I considered setting up a series of 'canary' emails so that I could track who's selling what but ... well never got round to it.

You used to be able to adjust your email address to check. For example if you email was bill@gmail.com, you could sign up for HN with bill+hackernews@gmail.com. Gmail ignores the part after the + sign. Therefore if you noticed emails coming to that address, you would know that HN sold their list. However, I've found that most forms reject that as a non-valid email address now.

[deleted]

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#136

Post by [deleted] »

outworlder wrote: post #131
giarc wrote: post #126

Earlier quoted context omitted.

You used to be able to adjust your email address to check. For example if you email was bill@gmail.com, you could sign up for HN with bill+hackernews@gmail.com. Gmail ignores the part after the + sign. Therefore if you noticed emails coming to that address, you would know that HN sold their list. However, I've found that most forms reject that as a non-valid email address now.

Yes. Those forms are also ignoring relevant RFCs.

[deleted]

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#137

Post by kbenson »

ShakataGaNai wrote: post #133

A quick python script to hit the API, for those that don't want to use the webform (rightly so): https://gist.github.com/ShakataGaNai/cb786a2c64abc83d4dbe0db...

Or, for those that don't want to use Python (in case it isn't installed, or requires a non-core module, I dunno) but have access to a Linux box:

    # echo -n "password" | sha1sum
    5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8  -
Take the first 5 characters, in this case "5baa6" and use at the end of the API endpoint in your browser. E.g.

    https://api.pwnedpasswords.com/range/5baa6
Then take the all the rest of the hash after the first 5 characters, in this case "1e4c9b93f3f0682250b6cf8331b7ee68fd8" and ctrl-f search the results page for it.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#138

Post by febed »

ChrisSD wrote: post #41
Lxr wrote: post #38

Earlier quoted context omitted.

Can you clarify what problem this solves?

As stated in the post, it's a simple solution to help with anonymity. "The password has been hashed client side and just the first 5 characters passed to the API As mentioned earlier, there are 475 hashes beginning with "21BD1", but only 1 which matches the remainder of the hash for "P@ssw0rd" and that record indicates that the password has previously been seen 47,205 times."

But Troy could still very easily guess the complete hash. It's the one with the 47,205 hits.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#139

Post by kalleboo »

giarc wrote: post #126
anitil wrote: post #113

Earlier quoted context omitted.

As a policy Troy Hunt won't reveal which breach he found your data in. I considered setting up a series of 'canary' emails so that I could track who's selling what but ... well never got round to it.

You used to be able to adjust your email address to check. For example if you email was bill@gmail.com, you could sign up for HN with bill+hackernews@gmail.com. Gmail ignores the part after the + sign. Therefore if you noticed emails coming to that address, you would know that HN sold their list. However, I've found that most forms reject that as a non-valid email address now.

I use a catchall address on my own domain name, and use sitename@domain.com to sign up for everything.

You should be using your own domain for email anyway

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#140

Post by JoBrad »

r3bl wrote: post #112
LeonM wrote: post #103

Earlier quoted context omitted.

For those who missed the hunter2 reference: http://bash.org/?244321

It was used just 16,092 times? I thought the number would be much bigger.

Adding a space after it reduces the number of times to 0. Quick fix!
Post reply on HN