Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

Post reply on HN
Print view View original

361–369 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#361

Post by path411 »

steferson wrote: post #297
ajro wrote: post #264

Earlier quoted context omitted.

"But if this is the case you should not trust any website with your password anwhere ever". That is why you should use unique password for each site.

This is absurd and impossible to remember, you should instead have at least 3 levels of password strenght, one high strenght for base services that are used to retrieve other accounts like facebook and e-mail, other for important services, and another for crap.

Use a password manager. It's so ridiculously easy to setup and makes it so much easier to log into sites.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#362

Post by path411 »

odammit wrote: post #360
brazzy wrote: post #357

Earlier quoted context omitted.

> Im saying you shouldnt have your authentication inside your business logic. It should be a separate service. And I am saying this is a wrong, counterproductive idea. It complicates your authetication for no substantial gain, and will only result in additional vulnerabilities. > Store your salt someplace secure, not in your frigging rails config.yml or inside env on your webservers or anything else that is publicly…

Wow you’re aggressive. Using something like Hashi Vault, Gluu, or Shiro does not overly complicate things. They’re stable, trusted solutions. It can also greatly simplify things. In the common scenario of having a web app for customers and a web app for admins, instead of them each having their own authentication baked in, you can choose an open source solution and deploy it twice, once for each service. I know how s…

He's talking about how each password should use a separate salt. This is normally stored next to the password hash. Many hashing algo implementations will even do this for you.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#363

Post by jaequery »

sah2ed wrote: post #244
jaequery wrote: post #233

Earlier quoted context omitted.

go a step further and you will get into key management devices like the HSMs and/or the Amazon KMS. KMS cost almost next to nothing and it is pretty neat since its a web service, especially coming from the world of $40k+ Thales/Safenet HSM devices which are a pain to deal with (backups, rehash, redundancy).

Mind sharing how you currently use Amazon KMS in practice?

It was to meet the PCI-DSS Level-1 security standards for banking compliance. We'd store encrypted cards in one place and store the master keys in the AWS KSM to later decrypt it. But to retrieve the master keys, it goes through another layer of encryption.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#364

Post by etxm »

path411 wrote: post #362
odammit wrote: post #360

Earlier quoted context omitted.

Wow you’re aggressive. Using something like Hashi Vault, Gluu, or Shiro does not overly complicate things. They’re stable, trusted solutions. It can also greatly simplify things. In the common scenario of having a web app for customers and a web app for admins, instead of them each having their own authentication baked in, you can choose an open source solution and deploy it twice, once for each service. I know how s…

He's talking about how each password should use a separate salt. This is normally stored next to the password hash. Many hashing algo implementations will even do this for you.

Cool. So if it’s in the same table, it’s just as secure as one salt sitting in a config file. When the table gets leaked, so does the salt.

Also, is he? More than one salt sounds too complicated for him.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#366

Post by fencepost »

grinsekatze wrote: post #282
ivanech wrote: post #170

I think it would be interesting to do an art project with this data - some of these passwords are funny and/or revealing. Some examples: pooplasagna - 3 times eggsarebad - 3 times eggsaregood - 25 times myhusbandcheats - 4 times icheatonmywife - 1 time ihatemyneighbors - 2 times iamanalcoholic - 6 times 1yearsober - 31 times imissmykids - 51 times imissmyparents - 6 times

6618 people love life, 1367 want to die. 893 people like turtles, 170 love turtles, 155 love everyone (363 people hate everyone though and 428 hate us all). 4301 people love their dog, 3 fuck their dog, 3 killed their dog (only one person killed their cat) 110 people are killers, 4 kill for money, 1 is a murderer. 68 want to kill, 24 kill for fun :-/ 2781 love their wife, 552 love their husband. 68 people hate their…

> The password donaldtrump is almost 5 times more popular than barrackobama.

This is a little late, but...

Right, but "donaldtrump" is only seen 40% as often as "barackobama". "donnaldtrump" is apparently perfectly safe though.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#367

Post by markdown »

aianus wrote: post #258
markdown wrote: post #215

Earlier quoted context omitted.

What a silly question. One can prove who they are with documents, but nobody can prove who they are with 2FA. It goes like this: If you can prove who you are, you get access to your account. That's what this is all about. The more offline, human touch we go, the greater the security.

It's way more likely that a hacker can convince a customer support rep that he's me than that hacker can steal my 2FA codes. This isn't a hypothetical, this happens all the time including to people I know personally: https://www.forbes.com/sites/laurashin/2016/12/20/hackers-ha...

That's not an inherent problem, that's poor implementation.

Procedures like this could work:

Person contacts support requesting a bypass of the 2FA due to whatever reason.

1. Cloudflare sends email to persons account notifying of the request. 2. Person is required to upload photographic proof of two govt-issued id's. 3. Cloudflare calls person (phone number on file from 2FA or account setup). 4. 30 day delay initiated. 5. 30 days layer, Cloudflare emails and calls person to confirm they requested 2FA bypass. 6. Access is granted.

With procedures like this, it's no longer about convincing a support rep.

Post reply on HN