Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

Post reply on HN
Print view View original

271–280 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#271

Post by professorTuring »

odammit wrote: post #245
professorTuring wrote: post #242

Earlier quoted context omitted.

Rule n1: don't roll your own security. Rule n2: goto 1 You are overcomplicating your authentication system by oversimplifying security problems and the result is that you have solved nothing. Security always seems very easy to solve and usually non-security engineers tends towards solutions like yours that doesn't provide extra security, they just add a few extra steps for a hacker to obtain you database and as a res…

You don’t have to “roll your own security.” You can easily put any open source security system behind a secondary system. Hell - it would already be a secondary system. Not putting your passwords right next to the identifiers is a simple way to lower the impact of an email or password leak. Also, that quote is bullshit.

Meh... I won't bother. Discuss your solution with a security guy you trust.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#272

Post by chatmasta »

always_good wrote: post #182
royce wrote: post #143

The UX of a blacklist with a half billion entries would be so crippling that it would cause a user revolt. Most people's password-selection strategies are similar enough to other people's (like kbenson's 4000+ hit) that they could spend hours trying to come up with a password that has never been leaked before. I tried to encourage Troy to suggest to implementors that blacklisting all passwords was a Bad Idea. Instead…

All depends on the threat model. Reusing username/email/password can cost your users hundreds per day on a gambling site. And users don't care about a password-gen guide. For example, in that case, you'd want to consider just generating passwords for them. But of course this would be silly for the run of the mill website.

That’s funny because coral.co.uk posts its login over HTTP. In fact if you try to login via https it redirects you to http. It would be fun to setup a hotspot called _The_Cloud outside a Coral and see what you find on the wire!

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#273

Post by maze-le »

ajro wrote: post #264
maze-le wrote: post #251

Earlier quoted context omitted.

If you don't trust troy hunt / haveibeenpwned.com you can always download the data and analyze your password yourself. But if this is the case you should not trust any website with your password anwhere ever, and should not create accounts anywhere. Troy Hunt has shown himself a responsible security professional, and I trust him more to create a secure password query than some other security organizations.

"But if this is the case you should not trust any website with your password anwhere ever". That is why you should use unique password for each site.

Yes, with unique passwords for each services, you narrow the attack surface to compromise other accounts. But you still have to trust the operator to store and process this one - unique - password on this one service/website. It does not make any difference for the argument, if one or many accounts are potentially compromised. And you have to trust your password-manager software, since it is next to impossible to remember all the different passwords for all the different services you use.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#274

Post by professorTuring »

brazzy wrote: post #261
odammit wrote: post #230

Split brain your password storage. Another table, another database or another storage system in general. If an attacker SQL injections your database don’t go spilling every hashed or unhashed password you’ve got. I tend to store passwords in a separate keyvalue store from where my authentication identifier is (email, “username”). If someone gets into my network they need to get into my servers with the email addresse…

Sorry, but this is convoluted nonsense that can only achieve one thing: make yourself more vulnerable. You want your security system to be as simple as possible, and to involve as little custom code as possible. Because you can and will fuck it up if you try to be clever. Hash and salt your passwords using a library designed exactly for that purpose (which means it will use a slow hash). That's it, end of story.

Agree.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#276

Post by swiley »

kirillkh wrote: post #227
irrational wrote: post #199

Earlier quoted context omitted.

People who love their moms are less intelligent than those who love their dads? There is a dissertation in psychoanalytics just waiting to be written.

> There is a dissertation in psychoanalytics just waiting to be written. Just don't wear a Hawaiian shirt while giving interview about it on TV.

What's wrong with them? I love those shirts! O.o

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#278

Post by nextgens »

zaroth wrote: post #92
nextgens wrote: post #72

Earlier quoted context omitted.

> I'm going to have to disagree with the premise that sites should stop users from choosing a password which happens to have been cracked offline at some point in the past Well, NIST, NCSC and Microsoft all seem to be on the same page: https://www.ncsc.gov.uk/guidance/password-guidance-simplifyi... https://pages.nist.gov/800-63-3/sp800-63b.html#5111-memorize... https://www.microsoft.com/en-us/research/wp-content/uplo…

NIST has unfortunately been the source of a lot of bad advice which has actively harmed password security the last decade. (e.g. [1]) Cargo culting is generally a good thing in crypto because, you know, don’t roll your own. But in this case we’re talking about policy. And this policy is as user hostile (if not worse) than the prior NIST advice on password expiry. If you want to stop password spraying, protect your ha…

> If you want to stop password spraying, protect your hashes.

Again, it's not about your hashes, it's about the attacker having access to your users' credentials.

Users re-use credentials accross services and you have no control on how (in)securely they are stored there.

Blacklisting (I don't have an opinion on how big the blacklist should be) what is known to be widely used accross services sounds sensible... and there is definitely an argument to be made about blacklisting what is known to be widely available/effective for attackers.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#279

Post by stordoff »

eof wrote: post #205

This is a tangent; but I had a 'pwned' password that I've used for years on steam that started getting hacked like 4-5x a week; I would just ignore the 2 factor attempts for several months. I finally changed the password to a slight variation that is not in this list (nor likely any others, 9 random alphanumerics); and within a week the two factor notifications started back up! I was really surprised; admittedly the…

Did you have any items in the account (TF2, DOTA2 etc.)? Some of them sell for silly prices (and it isn't always immediately obvious which), which can result in your account being targeted.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#280

Post by dansingerman »

This is so useful I've knocked up a quick gem to wrap the range service (i.e. it only transmits the first 5 chars of the SHA1 hash)

https://github.com/dansingerman/pwned_passwords_v2

The code is left deliberately simple so eyeballing lets you know it's not doing anything hinky with the passwords.

Post reply on HN