Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The 773M Record “Collection #1” Data Breach

troyhunt.com

Post reply on HN
Print view View original

41–50 of 128 posts

Re: The 773M Record “Collection #1” Data Breach

#41

Post by rincebrain »

sliken wrote: post #37
bbernoulli wrote: post #35

Earlier quoted context omitted.

The password itself is not sent. You can read about it here: https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...

He's suggesting using (the link is from your link): https://haveibeenpwned.com/Passwords Which does upload your password, which I think is an unacceptable risk.

You're either not reading the "how this protects your password" link that's on top of the page or claiming it's wrong. [1]

It sends the first N characters of the SHA1 hash of the password you provided to the server, the server replies with all the hashes it knows with that prefix, and then the client-side JS compares it to the rest of the hash it has.

If you don't believe me, you can look at the request said site issues for some arbitrary string - it's just the first 5 characters of the SHA1 hash, and the response from the server is as I (and that link) describe.

[1] - https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...

Re: The 773M Record “Collection #1” Data Breach

#42

Post by ehsankia »

NoPicklez wrote: post #8
zaroth wrote: post #2

Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached. So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehens…

He has the "Pwned Password" search to allow you to narrow it down and he has a really good article that he links to explaining why despite its inconvenience. If I was him I'd do the same. HIBP is a side project of his and I wouldn't be able to sleep at night knowing I have the responsibility of securing billions of email & password combinations. At the risk of the breach of those accounts adding fuel to the credentia…

There wouldn't be any inconvenience if your password manager did its job of helping you manage your passwords. 1Password has implemented a feature that helps you easily check all your passwords, I'm honestly surprised it's taking so long for the others to do too. The data is there, there's a super easy API, it doesn't take that much effort...

Re: The 773M Record “Collection #1” Data Breach

#43

Post by amanzi »

shmageggy wrote: post #21

What's the latest consensus on the best password manager these days. I see he is recommending 1Password, but I recently found Bitwarden which looks quite good.

Bitwarden (https://bitwarden.com/) is great and scores well in feature comparisons -- there was one on here recently. It's open source and has recently been audited too. It's free for the basic service, and really cheap for additional features. Great mobile apps and a web vault. And you can self-host. No bad points really.

Re: The 773M Record “Collection #1” Data Breach

#44

Post by sliken »

rincebrain wrote: post #41
sliken wrote: post #37

Earlier quoted context omitted.

He's suggesting using (the link is from your link): https://haveibeenpwned.com/Passwords Which does upload your password, which I think is an unacceptable risk.

You're either not reading the "how this protects your password" link that's on top of the page or claiming it's wrong. [1] It sends the first N characters of the SHA1 hash of the password you provided to the server, the server replies with all the hashes it knows with that prefix, and then the client-side JS compares it to the rest of the hash it has. If you don't believe me, you can look at the request said site iss…

So you are trusting the HTML/CSS and javscript downloaded from troyhunt.com with your plaintext password? Not to mention various bits from cloudflare.com, and other places.

There's some code that page uses: http://az416426.vo.msecnd.net/scripts/a/ai.0.js

Note the lack of https.

You are going to trust a page with that code with your important passwords?

Sure it claims to anonymize it first, but most don't know enough code to verify it themselves.

Much like trusting curl https://whatever.com | sudo /bin/bash

Crazy.

Re: The 773M Record “Collection #1” Data Breach

#45

Post by rincebrain »

sliken wrote: post #44
rincebrain wrote: post #41

Earlier quoted context omitted.

You're either not reading the "how this protects your password" link that's on top of the page or claiming it's wrong. [1] It sends the first N characters of the SHA1 hash of the password you provided to the server, the server replies with all the hashes it knows with that prefix, and then the client-side JS compares it to the rest of the hash it has. If you don't believe me, you can look at the request said site iss…

So you are trusting the HTML/CSS and javscript downloaded from troyhunt.com with your plaintext password? Not to mention various bits from cloudflare.com, and other places. There's some code that page uses: http://az416426.vo.msecnd.net/scripts/a/ai.0.js Note the lack of https. You are going to trust a page with that code with your important passwords? Sure it claims to anonymize it first, but most don't know enough…

So your claim has gone from "it uploads the password to the server" to "you trust unverified Javascript".

No, I don't have any particular reason to trust it.

I was just pointing out that the claim you made was inaccurate.

Re: The 773M Record “Collection #1” Data Breach

#46

Post by sliken »

sliken wrote: post #37
bbernoulli wrote: post #35

Earlier quoted context omitted.

The password itself is not sent. You can read about it here: https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...

He's suggesting using (the link is from your link): https://haveibeenpwned.com/Passwords Which does upload your password, which I think is an unacceptable risk.

Well it claims to take the first 5 characters of the SHA of the plaintext.

But it also pulls untrusted code/CSS from various sites over HTTP. It's far from unclear who controls that code.

For instance this wall of code: http://az416426.vo.msecnd.net/scripts/a/ai.0.js

A more sane approach would be to just put your passwords in a file, maybe by export from your database manager. Take a sha1 of each password, then submit those. That way you aren't trusting any random 3rd party sites to run safe code.

Re: The 773M Record “Collection #1” Data Breach

#47

Post by clort »

sliken wrote: post #37
bbernoulli wrote: post #35

Earlier quoted context omitted.

The password itself is not sent. You can read about it here: https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...

He's suggesting using (the link is from your link): https://haveibeenpwned.com/Passwords Which does upload your password, which I think is an unacceptable risk.

How about if you go to another device which you have not used before (maybe a library or internet cafe), do not identify yourself to the web in any way, open a sole link to that page and enter the passwords you wish to check. They are checked, but there is nothing to link them to you?

Of course, if we don't completely trust Troy Hunt and everybody associated with the site then we could assume that now those passwords have been added to a secret list of known unknowns, to use when trying to crack the hashed files they already have stored.

Security sure is difficult! I know it says at the top of the article that it is pitched at non-technical people but most of the people I know would have glazed over in the first few paragraphs..

Re: The 773M Record “Collection #1” Data Breach

#48

Post by sliken »

rincebrain wrote: post #45
sliken wrote: post #44

Earlier quoted context omitted.

So you are trusting the HTML/CSS and javscript downloaded from troyhunt.com with your plaintext password? Not to mention various bits from cloudflare.com, and other places. There's some code that page uses: http://az416426.vo.msecnd.net/scripts/a/ai.0.js Note the lack of https. You are going to trust a page with that code with your important passwords? Sure it claims to anonymize it first, but most don't know enough…

So your claim has gone from "it uploads the password to the server" to "you trust unverified Javascript". No, I don't have any particular reason to trust it. I was just pointing out that the claim you made was inaccurate.

Well it does, if you have javascript off, from the source (page says "If you submit a password in the form below, it will not be anonymised first")

Troy seems to have a fine reputation, but I don't want to trust the crown jewels (my passwords to everything) on Troy's reputation, the security of his site, cloudflare, and random javascript bits hosted in various places.

So sure the design and explanation of the page is that passwords are not uploaded. But since I can't practically verify that myself, I wouldn't upload passwords there. What's worse is even if I could audit every line of code, I couldn't guarantee other people wouldn't get a malicious version of the site.

So generally saying "Sure, type your password into a form on this webpage, I found an explanation that says it's not uploading it." is a very bad idea.

There's similarly plausible pages for things like generating SSL certs (not just CSRs), ssh keys, generating passwords for you, and similar that often have reassuring explanations that their security is just fine.

So generally never put your private key or plaintext password where a random 3rd party might read it. The promise that some anonymization process will be applied should not be enough to get you to risk it.

This reminds me of: http://bash.org/?244321

Re: The 773M Record “Collection #1” Data Breach

#49

Post by triangleman »

leetbulb wrote: post #30
unethical_ban wrote: post #23

Earlier quoted context omitted.

I use keepass. There are mobile apps and it can load from a cloud account.

KeePass + Syncthing + YubiKey = Awesome, and free!

Does keepass support yubikey out of the box or is there a certain plugin you use? What do you do about mobile?

Re: The 773M Record “Collection #1” Data Breach

#50

Post by sah2ed »

rjf72 wrote: post #16
zaroth wrote: post #2

Troy won’t store the passwords associated with the username, which is a choice I can absolutely respect. But as he discusses in the post, that leaves users knowing that their email address was in the data dump, but with no way of knowing which site it came from, or what password was breached. So while this increases the number of records in HIBP, and perhaps makes the password popularity tracker a bit more comprehens…

You can search by password here: https://haveibeenpwned.com/Passwords If you're as paranoid as you should be about then you can use an API to search using k-anonymity: https://api.pwnedpasswords.com/range/{hashPrefix} There you can replace "{hashPrefix}" with the first 5 characters of the SHA-1 of your password. It will return a list of all SHA-1's that start with the given 5 character prefix, as well as how many tim…

Troy Hunt explained how to find out if your password is pwned using the API in a comment [0]:

You need to look at the request being generated. Here's how to do it:

1) The SHA-1 of P@ssw0rd is 21BD12DC183F740EE76F27B78EB39C8AD972A757: https://passwordsgenerator.net/sha1-hash-generator/

2) Pass the first 5 chars to the API here: https://api.pwnedpasswords.com/range/21BD1

3) Find the suffix in the response and it has the count next to it: 2DC183F740EE76F27B78EB39C8AD972A757:51259

[0]: https://www.troyhunt.com/the-773-million-record-collection-1...

Post reply on HN