Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Am Releasing Ten Million Passwords

xato.net

Post reply on HN
Print view View original

151–160 of 229 posts

Re: I Am Releasing Ten Million Passwords

#151

Post by vpeters25 »

jbapple wrote: post #138
eurleif wrote: post #136

Earlier quoted context omitted.

>I'm not sure about "likely" https://en.wikipedia.org/wiki/United_States_free_speech_exce...

"threats may not be punished if a reasonable person would understand them as obvious hyperbole". Obviously, I don't know what the court would have held in this case, but it seems possible it would have held that this was "obvious hyperbole".

Could someone with legal background please explain the concept of "protected speech"?

I thought the Constitution is "where the buck stops", the Supreme Law. It takes precedent over any law, legal theory, precedent, tradition, etc.

The first amendment, as written, outright "enjoins" Congress from creating any "exceptions" or define what kinds of speech are actually protected.

I also think the Constitution provides one, and only one way for Congress to modify the 1st amendment so there can be categories of speech that can be "abridged": a constitutional amendment.

So, which kind of legal maneuvering, or reasoning as been used to somehow justify the amending of the 1st amendment without actually amending it?

Re: I Am Releasing Ten Million Passwords

#152

Post by MarkMc »

chias wrote: post #105
MarkMc wrote: post #97

Earlier quoted context omitted.

For sensitive sites, my preferred solution to this problem is to add a sequence of random characters to the User ID field. The user would then authenticate with something like this: User ID: John-CPE4E38J Password: snoopy For extra security the code would then move the random characters to the password so the authentication library would see this: User ID: John Password: snoopy-CPE4E38J In this way even an attacker w…

Is this materially different from requiring the user to have some random characters in the password, but for some reason making them type these characters into the username field where it'll be cached by the browser's autocomplete feature? It seems like this is an amusing enough hack to do on non-sensitive sites, but I wouldn't do this on anything "real". When it comes to authentication, "hey I had this really neat i…

If the random characters are stored in the User ID field then 95% of the time the user just has to remember their password. It is only when the user switches to a new computer that they would need to type in the random characters. Wouldn't that be a significant benefit over having to type the random characters every time the user logs in?

I agree with your observation that "hey I had this really neat idea" is almost always an immediate precursor to making things worse. Almost.

Re: I Am Releasing Ten Million Passwords

#153

Post by nmjohn »

brianshaler wrote: post #107
flavor8 wrote: post #36

Earlier quoted context omitted.

And then history -c

Depending on your system and configuration, couldn't you prepend a space to the command to prevent it from being saved into your history? edit: Looks like vacri mentioned this in a peer comment an hour ago. Whoops!

That works if you are using bash, but if you are, for example, using zsh, you would first have to run "setopt histignorespace" which would enable hiding lines prepended with a space in the history (it's off by default).

Re: I Am Releasing Ten Million Passwords

#154

Post by sandworm »

It was a mistake to release this today.

Everyone knows that legally questionable moves should always be made on a friday. That allows everyone in government to cool down for a couple days. By the time the weekend is over all the news outlets have moved on to whatever war just started up. You don't want some hothead prosecutor tweeting out a threat, forcing himself to follow through later in the week. Nobody picks a fight when 15 minutes away from a weekend.

Watch the NSA/CIA/MIB admissions. They always stage their spying/torturing me culpas on friday afternoons.

Re: I Am Releasing Ten Million Passwords

#156

Post by srcole »

What sorts of analyses are you guys planning? Maybe: -clustering of passwords. are aspects of the username biased towards certain clusters? -distribution of alphanumeric characters at each position of a password (e.g. 1 is a disproportionately common final character) -differences in password strength between usernames with male and female names

Re: I Am Releasing Ten Million Passwords

#157

Post by ryanlol »

dsrguru wrote: post #137
tptacek wrote: post #126

Earlier quoted context omitted.

EFF's reporting appears to be contradicted by the (now public) sentencing memo. Orin Kerr analyzed it at length for WaPo a few days ago.

Strange. Almost every article I'm finding echoes the EFF's statement about 48 months, but Judge Lindsay's own explanation of the sentencing is as Orin Kerr says. I wonder where that 48 figure came from. http://www.washingtonpost.com/news/volokh-conspiracy/wp-cont...

To be honest, EFF isn't exactly the most reliable source on these things. They too are very very biased.

Re: I Am Releasing Ten Million Passwords

#158

Post by ryanlol »

gayprogrammer wrote: post #103

Woah you are REALLY optimistic about law enforcement agencies wanting to focus on real criminals. But Barrett Brown is not the first or only example. Aaron Swartz is the only example I need to understand what to expect from the various US law enforcement agencies.

Barrett Brown intentionally did everything in his power (including, but not limited to publicly threatening named FBI agents and their families) to get targeted by LE, and succeeded.

Swartz? Swartz knowingly did several obviously illegal things (breaking-and-entering?) and then acted shocked when he got charged.

His actions may have been morally defensible, but not legally. Law enforcement did their job there.

Re: I Am Releasing Ten Million Passwords

#159

Post by kentonv »

vpeters25 wrote: post #151
jbapple wrote: post #138

Earlier quoted context omitted.

"threats may not be punished if a reasonable person would understand them as obvious hyperbole". Obviously, I don't know what the court would have held in this case, but it seems possible it would have held that this was "obvious hyperbole".

Could someone with legal background please explain the concept of "protected speech"? I thought the Constitution is "where the buck stops", the Supreme Law. It takes precedent over any law, legal theory, precedent, tradition, etc. The first amendment, as written, outright "enjoins" Congress from creating any "exceptions" or define what kinds of speech are actually protected. I also think the Constitution provides one…

"Freedom of speech" is understood to mean freedom to express any opinion or idea. It doesn't literally mean freedom to speak arbitrary words. There are many, many illegal acts which you can commit by merely speaking words, like fraud, blackmail, harassment, etc.

Re: I Am Releasing Ten Million Passwords

#160

Post by stinos »

LeoPanthera wrote: post #46

Fun! $ export LC_ALL='C' $ awk '{ print $2 }' 10-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20 55893 123456 20785 password 13582 12345678 13230 qwerty 11696 123456789 10938 12345 6432 1234 5682 111111 4796 1234567 4191 dragon 3845 123123 3734 baseball 3664 abc123 3655 football 3330 monkey 3206 letmein 3136 shadow 3126 master 3050 696969 3002 michael Edit: I used Wordle[1] to make a word…

So this dataset seems to be limited to english speaking qwerty using users, i.e. US only I guess?
Post reply on HN