Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Am Releasing Ten Million Passwords

xato.net

Post reply on HN
Print view View original

221–229 of 229 posts

Re: I Am Releasing Ten Million Passwords

#221

Post by pdabbadabba »

downandout wrote: post #218
tptacek wrote: post #214

Earlier quoted context omitted.

Couldn't you employ the same "free speech" logic to someone ordering a murder? Again, it's not the speech that's being criminalized; it's the intent animating it. Think of the link not as a crime in and of itself, but simply as evidence of Brown's effort to assist in the real crime, which was unambiguously illegal. If you follow the case closely, you'll see that's exactly what's being charged.

>Couldn't you employ the same "free speech" logic to someone ordering a murder? Nope. Ordering a murder is a crime. Sharing a link is not.

This doesn't strike me as very productive. Whether sharing a link can be a crime is, of course, exactly the point under debate.

And I don't see how you can dispute that whether sharing a link is a crime depends on what is accomplished, and what is intended, by sharing the link. There is, of course, no law that criminalizes sharing a link per se. But there are plenty of laws that criminalize things you can do by means of sharing a link. Take GP's example. You write up a murder-for-hire ad on your private server and post a link to it on HN. That's solicitation of murder, no less than if you had made the solicitation in person or by mail. You may as well argue that talking to someone, or sending a letter is not a crime.

Re: I Am Releasing Ten Million Passwords

#222

Post by lurkinggrue »

LeoPanthera wrote: post #46

Fun! $ export LC_ALL='C' $ awk '{ print $2 }' 10-million-combos.txt | tr 'A-Z' 'a-z' | sort | uniq -c | sort -nr | head -n 20 55893 123456 20785 password 13582 12345678 13230 qwerty 11696 123456789 10938 12345 6432 1234 5682 111111 4796 1234567 4191 dragon 3845 123123 3734 baseball 3664 abc123 3655 football 3330 monkey 3206 letmein 3136 shadow 3126 master 3050 696969 3002 michael Edit: I used Wordle[1] to make a word…

Cool! My password hunter2 wasn't at the top of the list!

Re: I Am Releasing Ten Million Passwords

#223

Post by pbreit »

tfinniga wrote: post #175
pbreit wrote: post #123

Earlier quoted context omitted.

So how would you utilize such knowledge in the real world?

You could use it to create a password strength meter for your website, and enforce a certain strength. Let's say it is common to include a subset of the username in passwords. Doing so would decrease the password strength and be disallowed. Also, you could look at certain usernames and compute likelihood of certain dictionary words, and disallow them. For example, a user named Bob might be unlikely to use spanish wor…

I just can't see how any of that is realistic or very useful. More energy needs to be spent on preventing breaches, not silly password requirements.

Re: I Am Releasing Ten Million Passwords

#224

Post by pbreit »

totony wrote: post #139
pbreit wrote: post #121

Earlier quoted context omitted.

OK, I'll bite: can you give us some ideas on how this would lead to a genuine advancement in user authentication (that we wouldn't have with username/pw de-linked)?

Example: Username: mickael Password: mickael69 EDIT: Just to be more precise, there is a correlation here, and with so much data a lot can be known. Patterns can then be forbidden from password fields so the website is less prone to dictionary attacks.

So what would you do here? Disallow "mickael" from the password? That's pretty user-hostile and almost completely pointless.

Re: I Am Releasing Ten Million Passwords

#225

Post by totony »

pbreit wrote: post #224
totony wrote: post #139

Earlier quoted context omitted.

Example: Username: mickael Password: mickael69 EDIT: Just to be more precise, there is a correlation here, and with so much data a lot can be known. Patterns can then be forbidden from password fields so the website is less prone to dictionary attacks.

So what would you do here? Disallow "mickael" from the password? That's pretty user-hostile and almost completely pointless.

Is it pointless to reduce the attack vector against your website? And, no, for a banking system, it is not that user-hostile to say things like "we have found that using in your password makes it easy for people to guess, please choose a more complicated password".

Re: I Am Releasing Ten Million Passwords

#226

Post by tfinniga »

pbreit wrote: post #223
tfinniga wrote: post #175

Earlier quoted context omitted.

You could use it to create a password strength meter for your website, and enforce a certain strength. Let's say it is common to include a subset of the username in passwords. Doing so would decrease the password strength and be disallowed. Also, you could look at certain usernames and compute likelihood of certain dictionary words, and disallow them. For example, a user named Bob might be unlikely to use spanish wor…

I just can't see how any of that is realistic or very useful. More energy needs to be spent on preventing breaches, not silly password requirements.

> More energy needs to be spent on preventing breaches

Hard to argue against that.

> not silly password requirements

You don't think that password requirements help prevent breaches?

Try this: hook up a server to the internet that's open to ssh. If you look at the ssh login attempt logs, you'll notice that you constantly have people banging against it, trying to log in as root. Yes, password requirements are a small part of overall security, but they are very helpful.

Re: I Am Releasing Ten Million Passwords

#227

Post by thaumaturgy »

presumeaway wrote: post #220
thaumaturgy wrote: post #165

Earlier quoted context omitted.

Yeah, I wish people would quit using "ad hominem", it's turning into a tell for "people who spend too much time online and still don't know how to disagree". Still, I think you're really overstating the risk here. The data set doesn't have email addresses and it doesn't list the specific services involved. How would you propose causing real harm to these real people using the data here, in a way that hasn't already b…

Do think it might cause harm if the domain names were retained?

I'm not sure.

Given what the author says about the data (it's all gathered from public sources, a lot of it is very old), it shouldn't matter whether the domain names or service names were there or not.

But then the data would go from being mostly anonymous to somewhat personal, and I couldn't defend that as much. Practically speaking, the risk of harm should still be really really low, but it just seems like a bad practice to distribute information that might be used to identify someone that's had their password leaked somewhere.

Re: I Am Releasing Ten Million Passwords

#229

Post by pbreit »

tfinniga wrote: post #226
pbreit wrote: post #223

Earlier quoted context omitted.

I just can't see how any of that is realistic or very useful. More energy needs to be spent on preventing breaches, not silly password requirements.

> More energy needs to be spent on preventing breaches Hard to argue against that. > not silly password requirements You don't think that password requirements help prevent breaches? Try this: hook up a server to the internet that's open to ssh. If you look at the ssh login attempt logs, you'll notice that you constantly have people banging against it, trying to log in as root. Yes, password requirements are a small…

Brute force attacks are too easy to mitigate. I'd like to see the energy go to defaulting against brute-force attacks.
Post reply on HN