I Am Releasing Ten Million Passwords

Post by sejje » Tue, Feb 10, 2015, 6:08 AM UTC

presumeaway wrote: post #140

totony wrote: post #135

Earlier quoted context omitted.

>Ad hominem + ad hominem Research requires data. If I want to do research on how best to implement my bank system, I would like to know what passwords are more likely to be contained in a dictionary attack. Usernames may have a high correlation with passwords and thus are useful. Considering all of these passwords can be obtained from obscure forums/websites and that the website where the IDs are used are not specifi…

> Research requires data. There's a lot of research that could be performed if we were willing to generate data without due regard for the inherent downsides. Saying research requires data is just insufficient justification in this case. > I don't see why he could not release it to the public for researchers to use. Because the collateral damage doesn't justify it. That aspect of it seems to be little more than a sid…

Post by presumeaway » Tue, Feb 10, 2015, 6:12 AM UTC

sejje wrote: post #141

presumeaway wrote: post #140

Earlier quoted context omitted.

> Research requires data. There's a lot of research that could be performed if we were willing to generate data without due regard for the inherent downsides. Saying research requires data is just insufficient justification in this case. > I don't see why he could not release it to the public for researchers to use. Because the collateral damage doesn't justify it. That aspect of it seems to be little more than a sid…

> A desire for a particular type of attention his ego seems to need. > moronic lack of appreciation > or an arrogance This is ad hominem. Here's a reference: http://en.wikipedia.org/wiki/Ad_hominem

Post by yeukhon » Tue, Feb 10, 2015, 6:14 AM UTC

Post by MarkMc » Tue, Feb 10, 2015, 6:35 AM UTC

IgorPartola wrote: post #102

MarkMc wrote: post #97

Earlier quoted context omitted.

For sensitive sites, my preferred solution to this problem is to add a sequence of random characters to the User ID field. The user would then authenticate with something like this: User ID: John-CPE4E38J Password: snoopy For extra security the code would then move the random characters to the password so the authentication library would see this: User ID: John Password: snoopy-CPE4E38J In this way even an attacker w…

This is a horrible practice. You are trying to implement two factor auth, but with a static second factor that will not be considered private by most users. It is a huge burden on them to remember, and is providing you with dubious security at best, and actually providing a vector of attack at worst. Please don't do this.

  1) Go to website.com and click 'Register'
  2) Enter your email address
  3) Think of a password and type it 
  4) Click 'I agree'
  5) Click 'Register'

  1) Go to website.com and click 'Register'
  2) Enter your email address  
  3) Think of a password and type it 
  4) Click 'I agree'
  5) On your phone, press the 'Play Store' or 'App Store' icon
  6) Press the 'Search' icon and search for 'Google Authenticator'
  7) Press 'Install' and wait for it to install (if you have an iPhone the install button might look like a little cloud icon)
  8) Press 'Open' to open Google Authenticator
  9) Press the 'Menu' button which looks like three dots in the top-right corner of the phone screen
  10) Choose 'Scan with barcode'
  11) Point the phone at the computer screen as though you were going to take a photo of the barcode on screen. 
  12) Wait for the phone to register the barcode, then enter the number shown on your phone into the website form
  13) Click 'Register'

Post by throwawaykf05 » Tue, Feb 10, 2015, 6:42 AM UTC

sarciszewski wrote: post #15

julianpye wrote: post #13

Everyone knows the whole email/password concept is broken. I believe that overall OAUTH is needed, but it needs a much stronger consumer facing view.

A well-implemented OAuth implementation is wonderful. Sadly, many implementations are just crappy.