Earlier quoted context omitted.
No it doesn't: -n do not output the trailing newline
He's saying echo without an argument emits a newline, so use -n to suppress it.
Oops. Thanks.
"Pwned Passwords" V2 With Half a Billion Passwords
331–340 of 369 posts
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#332In case anyone here is interested, I just did a livestream where I wrote a simple app in Nim to query this API.
On YouTube: https://www.youtube.com/watch?v=Di2O_lIPxb4
Source code: https://github.com/dom96/pwned
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#333Earlier quoted context omitted.
The point is not putting them in a system that can leak them right alongside the login identifier. If someone wants to go exercise 9384828388 GPUs on your list. Fantastic, at least the other piece of their auth username/etc isn’t sitting right next to it. Putting them in a separate system can be a simple REST server that sits in front of another database, LDAP or even something like Vault. Don’t set them right alongs…
Why are your juniors hacking in production? They get a testing environment, if lucky they can play with staging but production should not be hacked upon. I don't see the benefit of a seperate system still, if you really want to, LDAP already does all this. As does AD. Why reinvent the wheel and built a rest service for it? I also don't know why it's harmful if a hash sits next to the username, if the database has bee…
They aren’t “hacking on production.” They’re occassionlly under pressure to release features. If they don’t get someone that catches a SQL injection or something else silly in a PR it’s nice to know we cant possibly bleed our password hashes.
Do you jam all your tables into one public/default schema? Or do you break them up by domain across schemas?
A very simple implementation of this in Postgres is an auth schema. Only one role can read from the table with the credentials, no app has access to that role. You write a function to verify a credential and use a security definer to give a role that can use that function access to read a single result.
In this case you’ve mitigated two “attacks”:
- a sql injection selecting all from users
- some random engineer taking a schema dump for whatever purpose, accidentally grabbing auth details and then having that get leaked somehow down the line.
I literally takes a few lines of SQL to set that up. It’s not an extra server to manage. Just a different schema with higher security constraints.
From your app with the credentials to call that compare function instead of doing a SELECT FROM you can call that function with the credentials and just accept Postgres telling you yes or no the credentials matched.
PG has a suite of hashing functions. Take your pick. That function can do your salting or you could add it as a parameter to the call.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#334Earlier quoted context omitted.
You need both. https://www.trustedsec.com/2016/06/introduction-gpu-password...
The takeaway from that (which has been known for a decade at least) is that your passwords need to be hashed and salted, and you need to use a hashing algorithm designed for security (meaning it is slow). Not that you should complicate your system architecture and create more potential points of attack.
Absolutely, Im not stating otherwise. Im saying you shouldnt have your authentication inside your business logic. It should be a separate service. Limited access, and transparent to the application that is calling on it.
If you want that to be a REST service, great.
If you want it to be another table/schema/database/server, great.
If you want it to be something else, great.
Just stop putting it right inside the application that is taking user input.
Don't roll your own hashing, use something solid, like Argon2, salt your stuff. Store your salt someplace secure, not in your frigging rails config.yml or inside env on your webservers or anything else that is publicly addressable.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#335Earlier quoted context omitted.
And Northern Irish.
Personally I hear 'ma' more in Northern Ireland, never heard 'mam' (although maybe I am mishearing). mam - https://en.wiktionary.org/wiki/mam#English ma - https://en.wiktionary.org/wiki/ma#English
I heard `mammy` on Derry Girls which is supposed to be an Irish show.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#336I think it would be interesting to do an art project with this data - some of these passwords are funny and/or revealing. Some examples: pooplasagna - 3 times eggsarebad - 3 times eggsaregood - 25 times myhusbandcheats - 4 times icheatonmywife - 1 time ihatemyneighbors - 2 times iamanalcoholic - 6 times 1yearsober - 31 times imissmykids - 51 times imissmyparents - 6 times
hackernews - 3 times forgotmypassword - 155 times letmein - 184.274 times
>184.274
How is it a real number? Shouldn't it be a whole number?
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#337Re: "Pwned Passwords" V2 With Half a Billion Passwords
#338Earlier quoted context omitted.
> You should never use only 2FA for something you don't want to be locked out of. Tell that to... everyone. > You need a 3rd authentication method to replace the 2nd when you lose it, such as backup codes, that as well as a 4th one to recover a lost password. That's on Cloudflare. If they don't offer backup codes, what can an end user do about that?
Manually record the seed key when you set up 2FA (usually this is contained in a QR code). Keep it somewhere safe and offline. It can be used to recreate your 2FA setup.
I've never looked into that possibility. Thanks.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#339Earlier quoted context omitted.
I use a catchall address on my own domain name, and use sitename@domain.com to sign up for everything. You should be using your own domain for email anyway
> You should be using your own domain for email anyway Why? I trust Google to secure gmail.com better than I can secure my own domain.
People have had their Google accounts suspended (especially if it's associated to say, a YouTube or AdWords account), and now you have no access to your address anymore, and Googles free tier support won't help you.
With domains there's an ICANN process to get your domain back if it gets hijacked.
Re: "Pwned Passwords" V2 With Half a Billion Passwords
#340Earlier quoted context omitted.
Because: 1) In an online attack, against a properly-configured service, even if password spraying is used, only the first few thousand passwords can be tried before rate-limiting, CAPTCHAs, etc. kick in. Would a user with a known leaked password at a different site be vulnerable to an online correlation attack? Yes. And that's why some big services supplement their approach by proactively searching for those leaks an…
Eh, "We've got lots of users so it will take a long time to crack them all" isn't much of a defence. I mean, if you've got Obama or Snowden or Taylor Swift or Logan Paul or whoever as a user, you think hackers wouldn't spent 2 hours of GPU time per account to crack their passwords?
I'm quite familiar with password attack scenarios.
If high-value targets are selecting passwords that would be vulnerable to a targeted cracking attack, the solution isn't to blacklist a half-billion passwords (when they could just as easily come up with literally trillions of other passwords that would also be bad, yet are not included in the blacklist). The solution is to show them how to manage their specialized threat model - 2FA, creating strong passphrases, using a password manager, etc.