Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Pwned Passwords" V2 With Half a Billion Passwords

troyhunt.com

Post reply on HN
Print view View original

51–60 of 369 posts

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#51

Post by GordonS »

scrollaway wrote: post #27

[Pasting an old comment of mine on password managers, since I see people talking about starting to use Keepass. I hope this helps someone] ---- If you're just starting, here's some guidance on setting up a password manager. First of all: Don't be afraid of using one. It's not just more secure, it's super convenient. Never again will you ask yourself: Did I make an account for this website/service? What email did I us…

I use KeePass 2.x (can't be arsed switching to KeepassXC), but I absolutely second Keepass2Android. It supports a whole host of backends, which includes SFTP - great it you want to securely keep your password DB online without using a 3rd party service (e.g. Dropbox).

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#52

Post by erAck »

yarwelp_ wrote: post #11

On the topic of passwords, have a look at my command-line passphrase generation program. GitHub: https://github.com/ctsrc/pgen It's written in Rust. Install the Rust toolchain installer from https://rustup.rs/ curl https://sh.rustup.rs -sSf | sh And remember to add ~/.cargo/bin to your PATH. Then install my command-line utility cargo install pgen Usage is described in detail in the README on GitHub. Additionally you…

https://defuse.ca/passgen.htm uses /dev/(u)random on Linux and CryptGenRandom() on Windows, with source code on GitHub for Linux https://github.com/defuse/passgen and https://github.com/defuse/WinPassGen

Without a pile of dependencies :P

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#53

Post by ianlevesque »

orasis wrote: post #46

Can someone please just provide the exact shell commands to generate a compatible sha-1 of a password to grep against the database? The article seems to ramble forever about how to perform online checks without discussing the basic offline secure option.

echo -n "password" | openssl sha1 | tr '[:lower:]' '[:upper:]'

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#54

Post by hanklazard »

scrollaway wrote: post #27

[Pasting an old comment of mine on password managers, since I see people talking about starting to use Keepass. I hope this helps someone] ---- If you're just starting, here's some guidance on setting up a password manager. First of all: Don't be afraid of using one. It's not just more secure, it's super convenient. Never again will you ask yourself: Did I make an account for this website/service? What email did I us…

I've just switched from 1password to keepassxc in the past few weeks. The only reason I did so was because 1password was trying to force me into their subscription service as I switched from macOS to linux mint. I looked at a few work-arounds on github, but eventually just decided to move over to keepassXC.

The export / import and overall setup was pretty painless. I am still able to sync through dropbox just like with 1password. There is also an ios app called keepasstouch which was a breeze to get going and syncs with my dropbox password vault. Finally, the browser extension works in a very similar way to 1password's.

Overall, I definitely recommend it. I haven't lost any functionality or security to my knowledge. I was happy to pay up front for 1password (probably dropped 60-80$ or so for their apps), but, after doing so, just couldn't stomach being forced into their SaaS model. Especially when a similar free, open-source alternative exists.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#55

Post by [deleted] »

ChrisSD wrote: post #35
blibble wrote: post #21

Earlier quoted context omitted.

personally I've always just done: and picked a bit I liked

Picking the bit you like makes it hard to reason about how secure that is. It could be your preferences are much narrower than you realise. If you're going for something you find aesthetically pleasing or memorable then that's probably going to seriously limit password entropy. On the other hand if you're trying to pick something that "looks random" then you should know humans are terrible at that.

[deleted]

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#56

Post by mnutt »

benbristow wrote: post #49
orasis wrote: post #46

Can someone please just provide the exact shell commands to generate a compatible sha-1 of a password to grep against the database? The article seems to ramble forever about how to perform online checks without discussing the basic offline secure option.

http://onlinemd5.com/ Just uses JavaScript in the browser

I wouldn't recommend using this. Even if you were to read the page source and see that it is in fact not sending data back to a third party, either a) the site owner could change this in the future, or b) you could be man-in-the-middle'd since they're using http, or c) one of the third party scripts they run on that page could either accidentally or intentionally take your password. Don't put your password in there.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#57

Post by georgyo »

ianlevesque wrote: post #53
orasis wrote: post #46

Can someone please just provide the exact shell commands to generate a compatible sha-1 of a password to grep against the database? The article seems to ramble forever about how to perform online checks without discussing the basic offline secure option.

echo -n "password" | openssl sha1 | tr '[:lower:]' '[:upper:]'

echo -n "password"

echo adds a new line that is likely not in your password.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#58

Post by Felk »

orasis wrote: post #46

Can someone please just provide the exact shell commands to generate a compatible sha-1 of a password to grep against the database? The article seems to ramble forever about how to perform online checks without discussing the basic offline secure option.

echo -n "password" | sha1sum

then to remove the sha1sum's trailing spaces and dash: | sed 's/\s.*$//'

and then to uppercase it, as ianlevesque showed: | tr '[:lower:]' '[:upper:]'

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#59

Post by jffry »

orasis wrote: post #46

Can someone please just provide the exact shell commands to generate a compatible sha-1 of a password to grep against the database? The article seems to ramble forever about how to perform online checks without discussing the basic offline secure option.

  echo -n 'P@ssw0rd' | shasum -t 1 -
gives me the same value (21bd12dc183f740ee76f27b78eb39c8ad972a757) as appears in the article.

Re: "Pwned Passwords" V2 With Half a Billion Passwords

#60

Post by Ajedi32 »

jkaptur wrote: post #33
groovecoder wrote: post #19

do not skip the section on "Cloudflare, Privacy and k-Anonymity" ... it is a great summary of an elegant privacy solution. And check out Cloudflare's detail post too: https://blog.cloudflare.com/validating-leaked-passwords-with...

I'm a bit confused - why not distribute a serialized Bloom filter representing these passwords? That would seem to enable a compact representation (low Azure bill) and client-side querying (maximally preserving privacy).

There are half a billion passwords in the list. A bloom filter with even a 1 in 10 false positive rate would still be 286.59 MB.
Post reply on HN