What's the latest consensus on the best password manager these days. I see he is recommending 1Password, but I recently found Bitwarden which looks quite good.
The 773M Record “Collection #1” Data Breach
21–30 of 128 posts
Re: The 773M Record “Collection #1” Data Breach
#22If you're using keepass, there are some plugins to check against HIBP: https://keepass.info/plugins.html
I'm gonna download the passwords offline and try this plugin: https://github.com/mihaifm/HIBPOfflineCheck
(you can grab the offline passwords from here: https://haveibeenpwned.com/Passwords )
Re: The 773M Record “Collection #1” Data Breach
#23What's the latest consensus on the best password manager these days. I see he is recommending 1Password, but I recently found Bitwarden which looks quite good.
I use keepass. There are mobile apps and it can load from a cloud account.
Re: The 773M Record “Collection #1” Data Breach
#24Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached. So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehens…
You can search by password here: https://haveibeenpwned.com/Passwords If you're as paranoid as you should be about then you can use an API to search using k-anonymity: https://api.pwnedpasswords.com/range/{hashPrefix} There you can replace "{hashPrefix}" with the first 5 characters of the SHA-1 of your password. It will return a list of all SHA-1's that start with the given 5 character prefix, as well as how many tim…
Weird, I don't see any entries for password or password1 in there.
Re: The 773M Record “Collection #1” Data Breach
#25Earlier quoted context omitted.
You can search by password here: https://haveibeenpwned.com/Passwords If you're as paranoid as you should be about then you can use an API to search using k-anonymity: https://api.pwnedpasswords.com/range/{hashPrefix} There you can replace "{hashPrefix}" with the first 5 characters of the SHA-1 of your password. It will return a list of all SHA-1's that start with the given 5 character prefix, as well as how many tim…
Weird, I don't see any entries for password or password1 in there.
I get this when I try 'password':
Oh no — pwned! This password has been seen 3,645,804 times before
Re: The 773M Record “Collection #1” Data Breach
#26Earlier quoted context omitted.
Weird, I don't see any entries for password or password1 in there.
I get this when I try 'password': Oh no — pwned! This password has been seen 3,645,804 times before
I assume he was sending in the SHA-1s. And yeah, it looks like he (Troy Hunt / site operator) disabled the direct search by SHA-1 now that he's enabled the k-anonymity API. Was able to edit and update my original post to reflect this.
Re: The 773M Record “Collection #1” Data Breach
#27Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached. So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehens…
I know which passwords were breached by all the emails I get telling me "we know your password is XXXXXXXXX. Pay up or else". There's 4 or 5 in the first 30 messages in my email spam folder. >:(
Re: The 773M Record “Collection #1” Data Breach
#28Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached. So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehens…
The slightly annoying thing here is that I already use a password manager, so while the impact to me is minimal, I wish I knew which password specifically I have to rotate, instead of assuming that I need to rotate, like, all of them...
Why not use Pwned Passwords to check your passwords to see if any of them need to be rotated due to this breach or any other?
Re: The 773M Record “Collection #1” Data Breach
#29Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached. So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehens…
You can search by password here: https://haveibeenpwned.com/Passwords If you're as paranoid as you should be about then you can use an API to search using k-anonymity: https://api.pwnedpasswords.com/range/{hashPrefix} There you can replace "{hashPrefix}" with the first 5 characters of the SHA-1 of your password. It will return a list of all SHA-1's that start with the given 5 character prefix, as well as how many tim…
I wrote a Ruby script to check passwords back when the Pwned Passwords V2 API was introduced. I've added a second script to check a bulk list of passwords in a plain-text file.
https://gist.github.com/schmich/aeaffac922271a11b70e9a79a5fe...
Re: The 773M Record “Collection #1” Data Breach
#30What's the latest consensus on the best password manager these days. I see he is recommending 1Password, but I recently found Bitwarden which looks quite good.
I use keepass. There are mobile apps and it can load from a cloud account.
KeePass + Syncthing + YubiKey = Awesome, and free!