Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

Post reply on HN
Print view View original

161–170 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#161

Post by skykooler »

kbenson wrote: post #141
tomsmeding wrote: post #23

Earlier quoted context omitted.

You wouldn't manage that with a one-line shell script, assuming that you want to format it reasonably. :) I do agree that having to install loads of things for a simple tool is overkill, but I'd wager the actual binary produced doesn't have many dependencies (I'd expect just libc, in fact); so would this at some point land in a package manager, your life will improve.

Well... CHECKPW="p@ssword" SHA1=`echo -n "$CHECKPW" | sha1sum`; curl -s https://api.pwnedpasswords.com/range/${SHA1:0:5} | grep -i ${SHA1:5:34}

Note that this command doesn't work if your password contains an exclamation mark.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#163

Post by seanalltogether »

hmexx wrote: post #79

I just tried a 11 character password without special chars, that I’ve used on over 50 sites, over the last decade. It’s my password for throaway websites. Some pretty dodgy. Not in the database. Makes me feel pretty good about password security overall!

I just checked my very obscure 9 character password I use only for financial websites, and it appears 3 times.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#164

Post by royce »

odammit wrote: post #162

If you spend the time building a system to search those half billion passwords when you’re users are signing up, you should focus on building a login rate limiting system so it’s not possible to brute force someone’s password.

The purpose of a blacklist is multifold - to reduce the efficiency of an offline attack, in which the hashes are stolen and can be attacked at high speeds without rate limiting - as well as an online attack.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#165

Post by ravenstine »

odammit wrote: post #162

If you spend the time building a system to search those half billion passwords when you’re users are signing up, you should focus on building a login rate limiting system so it’s not possible to brute force someone’s password.

I think this is intended for the case where a database has been compromised, but then again, I thought that hash algorithms and salting were supposed to deal with that.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#166

Post by rphlx »

odammit wrote: post #162

If you spend the time building a system to search those half billion passwords when you’re users are signing up, you should focus on building a login rate limiting system so it’s not possible to brute force someone’s password.

Though I agree rate limiting should be done (and done carefully), it is not very effective in all cases. As just 1 example, a determined attacker who wants to pop any account can make 3 attempts on hundreds of thousands of accounts, using a unique IPv4 address per account, thanks to Windows & IoT botnets.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#167

Post by kingvash »

febed wrote: post #138
ChrisSD wrote: post #41

Earlier quoted context omitted.

As stated in the post, it's a simple solution to help with anonymity. "The password has been hashed client side and just the first 5 characters passed to the API As mentioned earlier, there are 475 hashes beginning with "21BD1", but only 1 which matches the remainder of the hash for "P@ssw0rd" and that record indicates that the password has previously been seen 47,205 times."

But Troy could still very easily guess the complete hash. It's the one with the 47,205 hits.

Yes but Troy doesn't learn the hashes of uncompromised passwords

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#168

Post by fuzzybeard »

giarc wrote: post #126
anitil wrote: post #113

Earlier quoted context omitted.

As a policy Troy Hunt won't reveal which breach he found your data in. I considered setting up a series of 'canary' emails so that I could track who's selling what but ... well never got round to it.

You used to be able to adjust your email address to check. For example if you email was bill@gmail.com, you could sign up for HN with bill+hackernews@gmail.com. Gmail ignores the part after the + sign. Therefore if you noticed emails coming to that address, you would know that HN sold their list. However, I've found that most forms reject that as a non-valid email address now.

Don't any half decent sites strip that out anyways? Some ecommerce sites have actually failed to accept that string, inadvertently thinking it's invalid. The rest, or any marketing CMS, would simply remove it.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#169

Post by loeg »

emmelaich wrote: post #154
outworlder wrote: post #131

Earlier quoted context omitted.

Yes. Those forms are also ignoring relevant RFCs.

Can you be more specific?

Many sites reject valid email addresses. One character it is common for forms to reject is a "+" in the left hand side of an email address. The email RFCs allow this character, so denying it is bogus. Nevertheless, they do.

https://tools.ietf.org/html/rfc2822#section-3.4

atext = ALPHA / DIGIT / ; Any character except controls, "!" / "#" / ; SP, and specials. "$" / "%" / ; Used for atoms "&" / "'" / " * " / "+" / "-" / "/" / "=" / "?" / "^" / "_" / "`" / "{" / "|" / "}" / "~"

atom = [CFWS] 1 * atext [CFWS]

dot-atom = [CFWS] dot-atom-text [CFWS]

dot-atom-text = 1 * atext * ("." 1 * atext)

...

addr-spec = local-part "@" domain

local-part = dot-atom / quoted-string / obs-local-part

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#170

Post by ivanech »

I think it would be interesting to do an art project with this data - some of these passwords are funny and/or revealing. Some examples:

  pooplasagna - 3 times
  eggsarebad - 3 times
  eggsaregood - 25 times
  myhusbandcheats - 4 times
  icheatonmywife - 1 time
  ihatemyneighbors - 2 times
  iamanalcoholic - 6 times
  1yearsober - 31 times
  imissmykids - 51 times
  imissmyparents - 6 times
Post reply on HN