Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

Post reply on HN
Print view View original

311–320 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#311

Post by tialaramex »

swiley wrote: post #276
kirillkh wrote: post #227

Earlier quoted context omitted.

> There is a dissertation in psychoanalytics just waiting to be written. Just don't wear a Hawaiian shirt while giving interview about it on TV.

What's wrong with them? I love those shirts! O.o

Some actual expert was on TV talking about space, a European space probe I think, wearing his Hawaiian shirt with ludicrous SciFi babes on it, and a certain type of person kicked off declaring that somehow SciFi babe Hawaiian shirt is misogyny incarnate or something.

The main outcome for me was that now two different friends own sofa cushions with the identical fabric pattern, they're a bit... garish? Both these friends are women, one of them is a bona fide scientist with a PhD and everything, so evidently the "No to SciFi babes on Hawaiian shirts" misogyny claims were less "mainstream feminism" and more "I'm just looking for reasons to be angry", but whatever, that's culture for you.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#312

Post by odammit »

zaarn wrote: post #256
odammit wrote: post #239

Earlier quoted context omitted.

You need both. https://www.trustedsec.com/2016/06/introduction-gpu-password...

I would argue that the benefit of putting all the hashes into a separate table is not really worth it. A separate service just to verify passwords sounds an awful lot like reinventing LDAP or AD/Kerberos with less features. It should be good enough to simply encrypt the password hashes with an application-side key, a simple database dump won't leak passwords anymore. If your passwords are properly hashed and stretche…

The point is not putting them in a system that can leak them right alongside the login identifier.

If someone wants to go exercise 9384828388 GPUs on your list. Fantastic, at least the other piece of their auth username/etc isn’t sitting right next to it.

Putting them in a separate system can be a simple REST server that sits in front of another database, LDAP or even something like Vault.

Don’t set them right alongside your ecommerce app you’ve got 30 juniors hacking on trying to get something out ASAP.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#313

Post by smoyer »

CurtMonash wrote: post #308

There's something odd about a website that urges you to test your security by typing in your password.

He specifically tells you that you shouldn't do that. But as the winning tool shows, perhaps people who have passwords in HIBP will changed them after finding this out?

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#315

Post by pbhjpbhj »

ythn wrote: post #12
roymurdock wrote: post #3

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites). I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/ I'd be interested to hear any suggestions for similar apps I could recommend to m…

Algorithmic password in your head, with a google spreadsheet to keep track of usernames, password rules, etc. on a per site basis (i.e. "bankofamerica, ythn.smith@gmail.com, 4-12 characters - no special). Edit: downvote away, but so far no one has ever been able to give a compelling reason why algorithmic passwords are bad. It has tradeoffs, sure, but so do password managers.

If a couple of your algorithmic passwords get leaked, attached to same email, then the algo could be guessed and you potentially lost all your accounts.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#316

Post by TallGuyShort »

grinsekatze wrote: post #282
ivanech wrote: post #170

I think it would be interesting to do an art project with this data - some of these passwords are funny and/or revealing. Some examples: pooplasagna - 3 times eggsarebad - 3 times eggsaregood - 25 times myhusbandcheats - 4 times icheatonmywife - 1 time ihatemyneighbors - 2 times iamanalcoholic - 6 times 1yearsober - 31 times imissmykids - 51 times imissmyparents - 6 times

6618 people love life, 1367 want to die. 893 people like turtles, 170 love turtles, 155 love everyone (363 people hate everyone though and 428 hate us all). 4301 people love their dog, 3 fuck their dog, 3 killed their dog (only one person killed their cat) 110 people are killers, 4 kill for money, 1 is a murderer. 68 want to kill, 24 kill for fun :-/ 2781 love their wife, 552 love their husband. 68 people hate their…

> 1 person is the president

Don't tell me he actually made that his password...

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#317

Post by maaark »

eni wrote: post #285

How trustworthy is /haveibeenpwned.com? Is there a chance the password people enter there for checking will end up in the databases?

There is almost zero chance Troy Hunt would torpedo his carreer doing something as monumentally stupid as that.

It's possible, sure. But I'd trust him with my password sooner than I'd trust [INSERT SV COMPANY HERE].

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#318

Post by pbhjpbhj »

blibble wrote: post #21
yarwelp_ wrote: post #11

On the topic of passwords, have a look at my command-line passphrase generation program. GitHub: https://github.com/ctsrc/pgen It's written in Rust. Install the Rust toolchain installer from https://rustup.rs/ curl https://sh.rustup.rs -sSf | sh And remember to add ~/.cargo/bin to your PATH. Then install my command-line utility cargo install pgen Usage is described in detail in the README on GitHub. Additionally you…

personally I've always just done: and picked a bit I liked

I do similar filtering to :graph:, or :alnum:, and dropping some characters.

What I keep meaning to do is optimise for different entry mechanisms, I know it reduces strength but going from lower to UPPER to specials to UPPER to lower to additional-specials, etc., is a huge pain on a 5-key entry system (eg FireTV).

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#319

Post by justinhj »

tialaramex wrote: post #311
swiley wrote: post #276

Earlier quoted context omitted.

What's wrong with them? I love those shirts! O.o

Some actual expert was on TV talking about space, a European space probe I think, wearing his Hawaiian shirt with ludicrous SciFi babes on it, and a certain type of person kicked off declaring that somehow SciFi babe Hawaiian shirt is misogyny incarnate or something. The main outcome for me was that now two different friends own sofa cushions with the identical fabric pattern, they're a bit... garish? Both these frie…

I remember that story. The shirt was actually made for the guy by a female friend as a gift

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#320

Post by espadrine »

jakobegger wrote: post #306

I love that simple API! Here's a bash one-liner that checks if 'hello' is compromised: curl -s https://api.pwnedpasswords.com/range/$(echo -n hello | shasum | cut -b 1-5) | grep $(echo -n hello | shasum | cut -b 6-40 | tr /a-f/ /A-F/) Edit: Improved one-liner that only requires typing the password once and avoids storing it in the bash history: (echo -n "Password: "; read pw; curl -s https://api.pwnedpasswords.com/ra…

You can use `read -s` to avoid risking having someone behind you read your password on your screen as you type it.

(echo -n "Password: "; read -s pw; curl -s https://api.pwnedpasswords.com/range/$(echo -n $pw | shasum | cut -b 1-5) | grep $(echo -n $pw | shasum | cut -b 6-40 | tr a-f A-F))

Post reply on HN