Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

Post reply on HN
Print view View original

251–260 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#251

Post by maze-le »

dandare wrote: post #250

Am I the only one here who thinks typing your password to a stranger's website is a risk? How do you know he does not log it? how do you know he was not hacked and someone is not logging all passwords that are not on the list YET.

If you don't trust troy hunt / haveibeenpwned.com you can always download the data and analyze your password yourself. But if this is the case you should not trust any website with your password anwhere ever, and should not create accounts anywhere. Troy Hunt has shown himself a responsible security professional, and I trust him more to create a secure password query than some other security organizations.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#252

Post by rfugger »

markdown wrote: post #216
lopmotr wrote: post #197

Earlier quoted context omitted.

You should never use only 2FA for something you don't want to be locked out of. You need a 3rd authentication method to replace the 2nd when you lose it, such as backup codes, that as well as a 4th one to recover a lost password.

> You should never use only 2FA for something you don't want to be locked out of. Tell that to... everyone. > You need a 3rd authentication method to replace the 2nd when you lose it, such as backup codes, that as well as a 4th one to recover a lost password. That's on Cloudflare. If they don't offer backup codes, what can an end user do about that?

Manually record the seed key when you set up 2FA (usually this is contained in a QR code). Keep it somewhere safe and offline. It can be used to recreate your 2FA setup.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#253

Post by lostlogin »

nkkollaw wrote: post #249
lysp wrote: post #220

Earlier quoted context omitted.

The number is under-represented because US English is not used worldwide: ilovemymum: 7928 ilovemymam: 926

Mam..?

Mammogram. Radiographic procedure that is painful and potentially life saving.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#255

Post by anonytrary »

lysp wrote: post #220
fny wrote: post #180

Earlier quoted context omitted.

ilovemymom 20141 ilovemydad 7850

The number is under-represented because US English is not used worldwide: ilovemymum: 7928 ilovemymam: 926

Pa, Pop, Dada, Daddy, Mommy, etc. There's work to be done here, folks!

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#256

Post by zaarn »

odammit wrote: post #239
ksenzee wrote: post #237

Earlier quoted context omitted.

> don’t go spilling every hashed or unhashed password you’ve got. Please don't store unhashed passwords. By now even PHP gives us the tools to do this right. You truly don't need secondary systems, or separate tables, or separate anything. Just hash the passwords.

You need both. https://www.trustedsec.com/2016/06/introduction-gpu-password...

I would argue that the benefit of putting all the hashes into a separate table is not really worth it. A separate service just to verify passwords sounds an awful lot like reinventing LDAP or AD/Kerberos with less features.

It should be good enough to simply encrypt the password hashes with an application-side key, a simple database dump won't leak passwords anymore.

If your passwords are properly hashed and stretched with appropriate and modern functions (SHA2/3 and Argon2) and encrypted-at-rest (Chacha20 or AES256) then you should be sufficiently equipped to secure your customers passwords against most attacks.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#257

Post by ChrisRR »

ivanech wrote: post #170

I think it would be interesting to do an art project with this data - some of these passwords are funny and/or revealing. Some examples: pooplasagna - 3 times eggsarebad - 3 times eggsaregood - 25 times myhusbandcheats - 4 times icheatonmywife - 1 time ihatemyneighbors - 2 times iamanalcoholic - 6 times 1yearsober - 31 times imissmykids - 51 times imissmyparents - 6 times

correcthorsebatterystaple - 103 times

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#258

Post by aianus »

markdown wrote: post #215
mulmen wrote: post #188

Earlier quoted context omitted.

If support can bypass 2FA why even have it?

What a silly question. One can prove who they are with documents, but nobody can prove who they are with 2FA. It goes like this: If you can prove who you are, you get access to your account. That's what this is all about. The more offline, human touch we go, the greater the security.

It's way more likely that a hacker can convince a customer support rep that he's me than that hacker can steal my 2FA codes.

This isn't a hypothetical, this happens all the time including to people I know personally: https://www.forbes.com/sites/laurashin/2016/12/20/hackers-ha...

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#259

Post by londons_explore »

maze-le wrote: post #251
dandare wrote: post #250

Am I the only one here who thinks typing your password to a stranger's website is a risk? How do you know he does not log it? how do you know he was not hacked and someone is not logging all passwords that are not on the list YET.

If you don't trust troy hunt / haveibeenpwned.com you can always download the data and analyze your password yourself. But if this is the case you should not trust any website with your password anwhere ever, and should not create accounts anywhere. Troy Hunt has shown himself a responsible security professional, and I trust him more to create a secure password query than some other security organizations.

No, you shouldn't trust this site with your password, like you shouldn't trust any site with your password.

Choose a new password for every site folks, and if you want to use a site like this, make sure the original places you used the password have been updated to a new one.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#260

Post by blauditore »

ivanech wrote: post #170

I think it would be interesting to do an art project with this data - some of these passwords are funny and/or revealing. Some examples: pooplasagna - 3 times eggsarebad - 3 times eggsaregood - 25 times myhusbandcheats - 4 times icheatonmywife - 1 time ihatemyneighbors - 2 times iamanalcoholic - 6 times 1yearsober - 31 times imissmykids - 51 times imissmyparents - 6 times

  hackernews - 3 times
  forgotmypassword - 155 times
  letmein - 184.274 times
Post reply on HN