Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Am Releasing Ten Million Passwords

xato.net

Post reply on HN
Print view View original

131–140 of 229 posts

Re: I Am Releasing Ten Million Passwords

#131

Post by yalogin »

meowface wrote: post #27

I don't understand exactly why it's necessary to release usernames along with the passwords, or why it's ethical to do so. Stripping the domain portion of email addresses does absolutely nothing when you can find the real email, and other accounts of the victim, by Googling the unique part of the email address. How does tying each password to its corresponding username help with password research, and does the value…

Before I go into the research aspect of it, there is no reason to hide the usernames from the passwords. They are already out there. The bad guys have them. So why not release them so that every one can look at them?

Also I am sure there are some research aspects to the usernames. At the very least behavioral deductions that can be drawn based on these combinations.

Re: I Am Releasing Ten Million Passwords

#132

Post by agersant »

bikamonki wrote: post #99
akerl_ wrote: post #90

Earlier quoted context omitted.

What site out there is sending my plaintext passwords to a 3rd party service to validate their strength?

Hopefully none, and hopefully they are all following best practices to protect your password, but you trust them regardless. Besides, who said plain text, such service could use ssl.

I think he meant plaintext as opposed to a hash of the password.

Re: I Am Releasing Ten Million Passwords

#133

Post by num »

LeoPanthera wrote: post #46

Fun! $ export LC_ALL='C' $ awk '{ print $2 }' 10-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20 55893 123456 20785 password 13582 12345678 13230 qwerty 11696 123456789 10938 12345 6432 1234 5682 111111 4796 1234567 4191 dragon 3845 123123 3734 baseball 3664 abc123 3655 football 3330 monkey 3206 letmein 3136 shadow 3126 master 3050 696969 3002 michael Edit: I used Wordle[1] to make a word…

  10938 12345
That's the same combination I have on my luggage!

Re: I Am Releasing Ten Million Passwords

#134

Post by Intermernet »

swatow wrote: post #84
exogen wrote: post #44

Earlier quoted context omitted.

Also interesting, how features of a username might correlate with password strength. Who do you think uses a stronger password, someone with the username "carguy551978" or someone with the username "w1ntermute"?

carguy followed by the 24'th n such that 1 + n + n^13 is prime, followed by the 34'th such n? I would expect a very, very strong password from someone who picks their username like that. (see https://oeis.org/search?q=__%2C+551%2C+__%2C+978&sort=&langu... )

You will like this: http://www.njohnston.ca/2009/06/11630-is-the-first-uninteres...

Re: I Am Releasing Ten Million Passwords

#135

Post by totony »

presumeaway wrote: post #127
meowface wrote: post #27

I don't understand exactly why it's necessary to release usernames along with the passwords, or why it's ethical to do so. Stripping the domain portion of email addresses does absolutely nothing when you can find the real email, and other accounts of the victim, by Googling the unique part of the email address. How does tying each password to its corresponding username help with password research, and does the value…

> I'm struggling to understand the intent here. A desire for a particular type of attention his ego seems to need. Which, combined with either a moronic lack of appreciation for the hassle and damage he's going to cause to end-users who've already been hosed once before, or an arrogance that makes him not care, makes him difficult to fit for a white hat. FTA: > This is completely absurd that I have to write an entire…

>Ad hominem + ad hominem

Research requires data. If I want to do research on how best to implement my bank system, I would like to know what passwords are more likely to be contained in a dictionary attack. Usernames may have a high correlation with passwords and thus are useful. Considering all of these passwords can be obtained from obscure forums/websites and that the website where the IDs are used are not specified, I don't see why he could not release it to the public for researchers to use.

Re: I Am Releasing Ten Million Passwords

#136

Post by eurleif »

jbapple wrote: post #129
eurleif wrote: post #125

Earlier quoted context omitted.

And as far as I can tell, it wasn't that what he said was constitutionally protected. It's that the statute he was charged under was unconstitutionally broad, because it prohibited "abusive language" in general. A more specific statute, prohibiting only threats, would have likely been ruled constitutional.

I'm not sure about "likely", but upon a closer reading, I agree that the Gooding decision looks like it was mainly about the broadness of the statute. Thanks for noting that.

>I'm not sure about "likely"

https://en.wikipedia.org/wiki/United_States_free_speech_exce...

Re: I Am Releasing Ten Million Passwords

#137

Post by dsrguru »

tptacek wrote: post #126
dsrguru wrote: post #124

Earlier quoted context omitted.

The threats actually accounted for 48 of the 63 months according to the EFF article that the OP linked to. https://www.eff.org/deeplinks/2015/01/eff-statement-barrett-...

EFF's reporting appears to be contradicted by the (now public) sentencing memo. Orin Kerr analyzed it at length for WaPo a few days ago.

Strange. Almost every article I'm finding echoes the EFF's statement about 48 months, but Judge Lindsay's own explanation of the sentencing is as Orin Kerr says. I wonder where that 48 figure came from.

http://www.washingtonpost.com/news/volokh-conspiracy/wp-cont...

Re: I Am Releasing Ten Million Passwords

#138

Post by jbapple »

eurleif wrote: post #136
jbapple wrote: post #129

Earlier quoted context omitted.

I'm not sure about "likely", but upon a closer reading, I agree that the Gooding decision looks like it was mainly about the broadness of the statute. Thanks for noting that.

>I'm not sure about "likely" https://en.wikipedia.org/wiki/United_States_free_speech_exce...

"threats may not be punished if a reasonable person would understand them as obvious hyperbole". Obviously, I don't know what the court would have held in this case, but it seems possible it would have held that this was "obvious hyperbole".

Re: I Am Releasing Ten Million Passwords

#139

Post by totony »

pbreit wrote: post #121
m8urn wrote: post #72

Earlier quoted context omitted.

As I explained in the article I seriously doubt that any more than a tiny number of these passwords are still valid. And there is no reason for them to be, having already been widely available, indexed (and cached) by every search engine, archived at archive.org, and downloaded by thousands or tens of thousands of people. Anyone who would use this data maliciously probably already has it. Much of this data is the sam…

OK, I'll bite: can you give us some ideas on how this would lead to a genuine advancement in user authentication (that we wouldn't have with username/pw de-linked)?

Example:

Username: mickael

Password: mickael69

EDIT: Just to be more precise, there is a correlation here, and with so much data a lot can be known. Patterns can then be forbidden from password fields so the website is less prone to dictionary attacks.

Re: I Am Releasing Ten Million Passwords

#140

Post by presumeaway »

totony wrote: post #135
presumeaway wrote: post #127

Earlier quoted context omitted.

> I'm struggling to understand the intent here. A desire for a particular type of attention his ego seems to need. Which, combined with either a moronic lack of appreciation for the hassle and damage he's going to cause to end-users who've already been hosed once before, or an arrogance that makes him not care, makes him difficult to fit for a white hat. FTA: > This is completely absurd that I have to write an entire…

>Ad hominem + ad hominem Research requires data. If I want to do research on how best to implement my bank system, I would like to know what passwords are more likely to be contained in a dictionary attack. Usernames may have a high correlation with passwords and thus are useful. Considering all of these passwords can be obtained from obscure forums/websites and that the website where the IDs are used are not specifi…

> Research requires data.

There's a lot of research that could be performed if we were willing to generate data without due regard for the inherent downsides.

Saying research requires data is just insufficient justification in this case.

> I don't see why he could not release it to the public for researchers to use.

Because the collateral damage doesn't justify it. That aspect of it seems to be little more than a side note to him.

He could quietly and securely give the data to established researchers.

Or, he could very publicly release a torrent for everyone's use, with almost no concern for how it'll be used.

There's a massive difference there and the likely potential reasons behind his decision to do the latter leave very little room for one to make favorable judgements about either his motives, or his ability to responsibly mitigating risk.

I'm sorry if you believe any of that to be ad hominem, but it just isn't.

> Usernames may have a high correlation with passwords and thus are useful.

And that's precisely why the likelihood of collateral damage stemming directly from his actions is much higher than it should reasonably be in this instance.

At some point what you're giving up to further research isn't worth the tradeoff. He's selling innocent bystanders up the river to further his own cause, with little evidence that he's done everything possible to limit collateral damage.

I don't understand why this line of thinking is a hard sell here.

When a government or corporation releases lightly-redacted, personally-identifying information about people, the outcry is (rightly) massive. White knight does it and, well, to question his motives is ad hominem?

Really?

Post reply on HN