Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Billions of login credentials have been leaked online

apnews.com

Post reply on HN
Print view View original

41–50 of 65 posts

Re: Billions of login credentials have been leaked online

#41

Post by cyberax »

throwaway09387 wrote: post #32
tiagod wrote: post #19

Earlier quoted context omitted.

I have my passkeys in 1password and they work fine. One key for each service, I don't see the difference to normal passwords in terms of lock-in

Look up passkey provider attestation. Services can't block your password manager, but they can block your passkey manager. It was used to threaten the KeePassXC devs into removing cleartext passkey exports.

That's incorrect. There is nothing in a passkey that identifies it as a "key from KeePassXC", so it can't be blocked.

BitWarden exports passkeys just fine as cleartext, or to be precise as a file encrypted by the user-specified passphrase. So you can then decrypt it at your leisure.

Re: Billions of login credentials have been leaked online

#42

Post by Larrikin »

krupan wrote: post #29

Can we be done with passwords yet? I see far too many sites offering a passkey option

If you have a password manager, what is the point of passkeys?

I was having this discussion earlier with a friend and we could not think of a compelling case. They seem less portable and harder to use on multiple devices or new devices. The only thing I could think of was protection against copied sites, but most users using password managers also block ads which should block most scam sites and password managers just need to have more messaging for if you try to fill in credentials on a site that is different from the site information saved with the password

Re: Billions of login credentials have been leaked online

#43

Post by jmward01 »

Our digital identities have become more valuable than most physical property but I still don't see society taking it seriously. People like my grandmother constantly shedding information to any pop-up that comes her way. Our governments not prioritizing this threat as a true top priority and properly funding it and taking action on it. (911 for digital crime maybe?) People not seeing others and properly shaming them and turning them in for digital crime like we would do if we saw property crime, etc etc. The scale of something like this is absurd, even if it is a lot of re-packaged data. The amount of time people will be dealing with the fall-out from just this one incident can likely be measured in thousands of people years. Or, put another way, this is on par with the impact of mass murder in term of lives altered. As a society we really need to make changes in our laws and behavior to really internalize how massive a problem this is before we can even start to address it.

Re: Billions of login credentials have been leaked online

#45

Post by pvg »

Larrikin wrote: post #40
gnabgib wrote: post #34

Dubious origin, lots of other copies: (17 points) https://news.ycombinator.com/item?id=44316114 (30 points, 3 comments) https://news.ycombinator.com/item?id=44318192 (12 points, 4 comments) https://news.ycombinator.com/item?id=44320243 (26 points, 15 comments) https://news.ycombinator.com/item?id=44321381 (9 points, 2 comments) https://news.ycombinator.com/item?id=44322204 (11 points, 2 comments) https://news.ycombin…

There is no world where AP is dubious and Forbes deserves the click

AP is reporting what others are reporting. What's dubious is the original reporting.

Re: Billions of login credentials have been leaked online

#46

Post by master-12 »

Larrikin wrote: post #42
krupan wrote: post #29

Can we be done with passwords yet? I see far too many sites offering a passkey option

If you have a password manager, what is the point of passkeys? I was having this discussion earlier with a friend and we could not think of a compelling case. They seem less portable and harder to use on multiple devices or new devices. The only thing I could think of was protection against copied sites, but most users using password managers also block ads which should block most scam sites and password managers jus…

Malicious website that looks like your bank can't get you to tell it your passkey, but you can type in your password.

(WebAuth checks the domain before signing)

Re: Billions of login credentials have been leaked online

#47

Post by tptacek »

tialaramex wrote: post #33
airstrike wrote: post #15

> According to a report published this week, Cybernews researchers have recently discovered 30 exposed datasets that each contain a vast amount of login information — amounting to a total of 16 billion compromised credentials. That includes user passwords for a range of popular platforms including Google, Facebook and Apple. Can someone more knowledgeable than me explain how my passwords could have been leaked from G…

Others have explained what's really going on here, but I want to take a moment to address this idea that they don't "have my passwords" because that's illuminating too. In a very real sense most of these systems, almost everything on the web today, do have your password, though that wasn't necessarily the direct cause of the problem here. Passwords in this context are a shared secret. You remember your Google passwor…

We have not had augmented PAKEs that were widely trusted by the cryptographic engineering community for decades. OPAQUE was 2018. The adoption you're looking for hasn't happened for a bunch of reasons, including:

* The industry's (reasonable) emphasis on moving people away from passwords altogether, and towards phishing-proof authentication.

* The fact that we'd have to do new underlying protocol work to meaningfully get the benefit you're talking about --- you can't just do it in Javascript, because you're talking about "server-proofing" logins, a threat model that presumes the attacker controls the server's login flow.

* Just the baseline fact that "losing passwords directly from Apple and Google and Meta authentication servers" hasn't been a driver of account takeovers, and you will never get PAKE adoption from the kinds of providers who do drive these incidents.

PAKEs are just a technology cryptography nerds fall in love with and want to find use cases for. I like them too! Build more things like Magic Wormhole. Don't get grumpy when the entire web doesn't wrap itself around them.

Re: Billions of login credentials have been leaked online

#48

Post by DidYaWipe »

foxygen wrote: post #9
DidYaWipe wrote: post #8

This is a good reminder that forcing people to use an E-mail address as a user ID is a stupid and dangerous policy. Voted down by amateurs who set their Web apps up this way. Killing the messenger won't secure your users' credentials.

As if users wouldn't just use the same username everywhere. So now besides telling them to use different passwords for every website, you also need to tell them to use different usernames.

So what? At worst, it's no worse. But by default, it's already way better.

Why? Because all of our E-mail addresses are on thousands of spammers' lists. So if you hammer that list with a dictionary of popular passwords, you're going to get a bunch of compromised accounts right there.

But even worse: When you force non-tech-savvy people to use their E-mail address as their ID, many are going to think they need to use their E-mail password as well. So now if one poorly-run site suffers a data breach, all of its users' E-mail addresses AND passwords are out there. Identity theft ahoy.

Not to mention the loss of people's accounts when they change E-mail addresses; When Apple started requiring that Apple IDs be E-mail addresses, it created a massive problem of people having purchases scattered across multiple accounts because they'd create a new one when their E-mail address changed.

After the outcry, Apple huffily declared that it wasn't going to let people consolidate their accounts.

But back to the point: Allowing people to create a proper user ID as free-form text doesn't preclude them from using their E-mail address if they insist on doing so. But they should be encouraged not to.

Re: Billions of login credentials have been leaked online

#49

Post by stock_toaster »

tialaramex wrote: post #33
airstrike wrote: post #15

> According to a report published this week, Cybernews researchers have recently discovered 30 exposed datasets that each contain a vast amount of login information — amounting to a total of 16 billion compromised credentials. That includes user passwords for a range of popular platforms including Google, Facebook and Apple. Can someone more knowledgeable than me explain how my passwords could have been leaked from G…

Others have explained what's really going on here, but I want to take a moment to address this idea that they don't "have my passwords" because that's illuminating too. In a very real sense most of these systems, almost everything on the web today, do have your password, though that wasn't necessarily the direct cause of the problem here. Passwords in this context are a shared secret. You remember your Google passwor…

We also have passkeys now too.

Re: Billions of login credentials have been leaked online

#50

Post by tialaramex »

tptacek wrote: post #47
tialaramex wrote: post #33

Earlier quoted context omitted.

Others have explained what's really going on here, but I want to take a moment to address this idea that they don't "have my passwords" because that's illuminating too. In a very real sense most of these systems, almost everything on the web today, do have your password, though that wasn't necessarily the direct cause of the problem here. Passwords in this context are a shared secret. You remember your Google passwor…

We have not had augmented PAKEs that were widely trusted by the cryptographic engineering community for decades. OPAQUE was 2018. The adoption you're looking for hasn't happened for a bunch of reasons, including: * The industry's (reasonable) emphasis on moving people away from passwords altogether, and towards phishing-proof authentication. * The fact that we'd have to do new underlying protocol work to meaningfully…

My Google account is indeed protected with Yubikeys and so on. Years after I bought my first Security Key, I can name all the places I use it, whereas if I type 'pass' the list goes on for several screens.

But while it's true that OPAQUE is what you might choose today, SRP is much older. We didn't have AES in 1995, we certainly didn't have a workable AEAD but instead of waiting for 21st century technology Netscape shipped SSL - very flawed but points in the correct direction.

The web actually went backwards in a sense. HTTP is designed with an authentication layer, but it's not up to the task for modern systems so nobody uses it in user facing software, only some APIs.

This feels like a theme - we can have better things, improvement is possible. "Oh well, it's never getting any better than this" isn't quite as stupid as "Nothing could be worse" (followed often very shortly by the discovery that you've underestimated how bad it could get e.g. electing the "outsider" and then electing him against now he's a felon) but it's still a mistake.

As you may know I have a habit of re-reading old stuff I wrote, one of the classics is from when Let's Encrypt launched and I'm explaining to Peter Gutmann about ACME. Peter's take is that we shouldn't make these protocols at all, they're a waste of time, and if we want one SCEP already exists. As you know, ACME has been an enormous success, but at the time this was not obvious. Peter was assuming that it's never getting any better, but it actually got almost unrecognisably better and quite quickly.

Post reply on HN