Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

351–360 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#351
post #349

Earlier quoted context omitted.

> Hash lists are bought, sold, traded, ... All only possible after the horse has escaped the barn. > Someone who possesses that particular hash may be multiple hops away from the group that originally acquired them. But if the hash is for a password that was only used on the original compromised system, it is useless, even if the password is recovered.

Just because the horse is out of the barn doesn't mean that the owner of the barn knows about it yet.

Right! So (from the perspective of the password alone) the owner doesn't have to care if that password is used only on that site where the horse has left the barn.

If the password is used on other sites, then of course all that protects them its strength relative to the compute resources thrown at it, relative to the time between the breach and discovery.

(From other perspectives, the user does care: like their credit card number was stolen and is being misused.)

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#352
post #350

Earlier quoted context omitted.

> If they were randomly generated and of sufficient length, yes. What does that buy you, if they are in plain text? (Well, randomness quasi-guarantees that they are not re-used; I covered that.) If we have passwords in plain text, issues about length related to cracking hashes is moot; the cracking that still matters is someone guessing at the login prompt, where we can lock out accounts after N attempts.

What about the other case - when they're not random, but also not reused ... such that the psychology of the user's password-selection methodology might be exposed?

If you have a password selection methodology that you do not change when hashed passwords are compromised, then it doesn't help you. The methodology will be uncovered once the password is cracked, even if that specific password doesn't itself work anywhere anymore. It's somewhat better if the methodology is discovered later than earlier, I suppose.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#353
post #236

Earlier quoted context omitted.

I don't think encouraging people to download the precompiled Rust binaries and then blindly compile code downloaded from crates.io is that much different in practice to providing your binaries.

I linked the GitHub repo first. The code is short and the assumption is that you would have a quick glance over the source before you compile it.

If you're trying to encourage people to implicitly trust as few things as possible, I'm not sure your suggested steps are enough: there's no connection between the code in pgen on crates.io and that repository. Even setting aside the prebuilt rust and cargo, I think there would have to be a guarantee that the code being built is the code the suspicious user actually inspected:

  git clone https://github.com/ctsrc/pgen
  cd pgen
  less src/main.rs build.rs # etc.
  cargo install # (installs the current package)
And, one would have to somehow do the same for the dependencies clap and rand, to ensure the code that is built is the code that is inspected.

It's true that avoiding pre-built binaries does avoid issues with the computer that builds them, and problems with the distribution mechanism, but instead distributing as source from external package repositories (and packages maintained by others) seems like it's losing convenience without gaining much security.

In any case, neat project! I like the option to throw physical dice.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#354

Earlier quoted context omitted.

That moment when you test a very unique password you used to use and it's been pwned once.. GULP! Glad I stopped using that one

Same experience here, except mine was current until shortly after I checked it. The weird part is that I only used it on internal systems at work. With an overly paranoid security department. Either they’re paranoid in the wrong ways, or I have an evil twin somewhere. At least, I hope they’re the evil twin...

time for some soul-searching

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#355
post #322

Earlier quoted context omitted.

Why are your juniors hacking in production? They get a testing environment, if lucky they can play with staging but production should not be hacked upon. I don't see the benefit of a seperate system still, if you really want to, LDAP already does all this. As does AD. Why reinvent the wheel and built a rest service for it? I also don't know why it's harmful if a hash sits next to the username, if the database has bee…

They aren’t “hacking on production.” They’re occassionlly under pressure to release features. If they don’t get someone that catches a SQL injection or something else silly in a PR it’s nice to know we cant possibly bleed our password hashes. Do you jam all your tables into one public/default schema? Or do you break them up by domain across schemas? A very simple implementation of this in Postgres is an auth schema.…

SQL Injection is to my knowledge not a problem if you use literally any query building method but string concatenation.

Any sane SQL driver offers queries with parameters and at work and in private I enforce the usage of parameters in queries entirely. If I find myself needing string concat anyway then I will do it very carefully and isolated from user input.

That mitigates SQL injection.

I also see no benefit in breaking it up into multiple schemas or pushing authentication entirely into SQL. At best that means you complicated the database definition unnecessarily and secondly it means your database gets raw password strings which is contra to what I learned about password security, namely that the raw password does not touch the DB or the DB driver or any DB related code. Ever.

I also don't see how engineers dumping the DB and then accidentally leaking it is a tangible risk. I'd put that on the bottom of my list of things I have to worry about when I verify passwords.

Not everyone works with PG either or even MySQL or there is no possibility of setting up functions or triggers in the database.

>If they don’t get someone that catches a SQL injection or something else silly in a PR it’s nice to know we cant possibly bleed our password hashes.

Which is totally irrelevant if you properly secure the application, do proper code reviews and don't put juniors under pressure to push out code at all costs.

Pushing crappy code because deadline is asking for it. End of story.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#356
post #286

Earlier quoted context omitted.

Personally I hear 'ma' more in Northern Ireland, never heard 'mam' (although maybe I am mishearing). mam - https://en.wiktionary.org/wiki/mam#English ma - https://en.wiktionary.org/wiki/ma#English

I heard `mammy` on Derry Girls which is supposed to be an Irish show.

Yeah, my Irish family say 'mammy'.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#357
post #262

Earlier quoted context omitted.

The takeaway from that (which has been known for a decade at least) is that your passwords need to be hashed and salted, and you need to use a hashing algorithm designed for security (meaning it is slow). Not that you should complicate your system architecture and create more potential points of attack.

Absolutely, Im not stating otherwise. Im saying you shouldnt have your authentication inside your business logic. It should be a separate service. Limited access, and transparent to the application that is calling on it. If you want that to be a REST service, great. If you want it to be another table/schema/database/server, great. If you want it to be something else, great. Just stop putting it right inside the appli…

> Im saying you shouldnt have your authentication inside your business logic. It should be a separate service.

And I am saying this is a wrong, counterproductive idea. It complicates your authetication for no substantial gain, and will only result in additional vulnerabilities.

> Store your salt someplace secure, not in your frigging rails config.yml or inside env on your webservers or anything else that is publicly addressable.

So you don't even understand how a salt works. Why should we take security advice from you again?

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#358
post #355

Earlier quoted context omitted.

They aren’t “hacking on production.” They’re occassionlly under pressure to release features. If they don’t get someone that catches a SQL injection or something else silly in a PR it’s nice to know we cant possibly bleed our password hashes. Do you jam all your tables into one public/default schema? Or do you break them up by domain across schemas? A very simple implementation of this in Postgres is an auth schema.…

SQL Injection is to my knowledge not a problem if you use literally any query building method but string concatenation. Any sane SQL driver offers queries with parameters and at work and in private I enforce the usage of parameters in queries entirely. If I find myself needing string concat anyway then I will do it very carefully and isolated from user input. That mitigates SQL injection. I also see no benefit in bre…

The fantasy world you work in must be great. I’m jealous.

I don’t know how many times I’ve seen someone jam a gigantic pile of string into a query builders select method or done some whack string interpolation trying to make a clever search form instead of using a tool like ransack or the equivalent.

Like I said, that was a for instance using Postgres, you can do it plenty of ways. Hashi Vault has been an awesome tool for this recently.

Getting the password near your database isn’t the problem. It’s persisting it unhashed that is. I’d conjectire a fair amount of sites terminate SSL at the edge of their network (nginx, ALB) and they have a password floating through the stack in plain text until it hits a compare method. What does it matter if that method is in your app code versus pg or vault or any tool you’d use for credential storage? Are you sure your app is scrubbing all the json keys or http field names that could contain a password to make sure it’s not going into your rails/node/whatever logs or into your nginx access logs?

Having multiple schemas isn’t complication, it’s organization.

As far as people doing dumb shit with files they’ve dumped or downloaded. It happens.

When you’re designing a system for storing credentials you don’t know who will work on this system or what practices will be in place around code quality, reviews and deadlines when you’re gone. You can’t literally watch every PR or guarantee that ever code review has someone as smart as Zaarn presiding over it.

You should be designing something people can’t shoot themselves in the foot with.

An example of a totally reasonable mistake to make i saw recently in a PR in a client I work with.

They had designed a pretty solid API using the JSONAPI spec. JSONAPI if you aren’t familiar allows an API client to request what fields they need from the endpoint instead of just getting all the fields the API returns. This is nice for mobile clients.

They had the forethought to exclude allowing people to ask for “password” through the /users API. Nice. Nailed it.

A year passes.

They add a feature for changing your password that required you to confirm by email that’s the password change was you and then it swapped the password from the “new_password” column to the “password” column. While this PR was in staging you could do /users?include=new_password and it’d return their new password (hashed, but still).

Password resetting was a feature they were adding to their registration and auth code.

The people that worked on that front end didn’t necessarily work on the user API and weren’t familiar with how it worked. But by adding this flow and this field the created a vulnerability in a tangentially related system.

Now I’m sure you could crap on JSONAPI but it serves a purpose. If they hadn’t been using that someone just as lazily could have designed the regular JSON endpoint to return all fields but password and they’d have ended up in the same boat.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#359

Earlier quoted context omitted.

correcthorsebatterystaple - 103 times

this one is quite amazing, I expected it to be one of the weakest around today, I certainly would include it in one of my first attempts if I tried to brute force any password.

There’s no guarantee those accounts hold any value, though. A throwaway account is the perfect chance for such a password — you won’t forget it and won’t care if you lose it.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#360
post #357

Earlier quoted context omitted.

Absolutely, Im not stating otherwise. Im saying you shouldnt have your authentication inside your business logic. It should be a separate service. Limited access, and transparent to the application that is calling on it. If you want that to be a REST service, great. If you want it to be another table/schema/database/server, great. If you want it to be something else, great. Just stop putting it right inside the appli…

> Im saying you shouldnt have your authentication inside your business logic. It should be a separate service. And I am saying this is a wrong, counterproductive idea. It complicates your authetication for no substantial gain, and will only result in additional vulnerabilities. > Store your salt someplace secure, not in your frigging rails config.yml or inside env on your webservers or anything else that is publicly…

Wow you’re aggressive.

Using something like Hashi Vault, Gluu, or Shiro does not overly complicate things. They’re stable, trusted solutions.

It can also greatly simplify things. In the common scenario of having a web app for customers and a web app for admins, instead of them each having their own authentication baked in, you can choose an open source solution and deploy it twice, once for each service.

I know how salt works. Don't belittle me.

If someone gets into your web servers they’ve pretty much got carte blanche at your database the web server has access to. They also now have your code, which in a lot of cases is probably plainly readable. So they can see your salt, see how you salt and see the hashing algorithm you've chosen.

I’m saying don’t store the salt in your apps config right along with the credentials to access all of your login identifiers and hashed passwords.

You gave them a piece of the puzzle. If someone wants to grind through and crack all the salted/hashed passwords, I'd prefer them not to have the salt to help in that endeavor.

Post reply on HN