My concern is with faulty code when checking this list.
if (isPwInBlackList(propossedPw)) throw new Exception("Proppossed pw is in black list");
logger.info("Password {} is OK.", propposedPw); //<-- faulty code here
86% of CrashCrate subscribers used passwords already leaked in other breaches
81–90 of 145 posts
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#82My biggest bugbear is with the really important sites like Apple and Google who force you to type out your passwords several times a day when using their services. I really want to pick a long complex password, but not if I have to keep typing it into login screens or pop-up windows where password managers don't work. Microsoft is doing a lot of good things in this area with passwordless logins and asking for PIN codes instead of passwords. I wish Google and Apple would follow suit.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#83Earlier quoted context omitted.
You have that backwards. You don't bruteforce a single password. You compute the hashes of all the dictionary words and then compare the hashes. So your 'trillion years' is probably more along the lines of a few weeks, for all the words in the dictionary at once.
Sure, and that's why salted hashes are a thing.
Yes! (I've edited my comment and added "and salt") and with a tiny bit of obscurity like a hashing algorithm that can't easily be calculated by a GPU or ASIC, then the hackers probably wont bother. Because scrypt is used by Litecoin, Dogecoin, et.al there are now ASIC's capable of billions of scrypt hashes per second.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#84Earlier quoted context omitted.
People should use password managers, but it's a crutch.
I'm not sure what you are saying ... should I memorize dozens of passwords like WCLfx(edI%uHgjWM6RuEeC6Qh for the services I use or should I strap on getting those dozens of services to use a perfect SSO service that doesn't leak privacy and is perfectly secure and doesn't exist yet?
I'm saying all solutions are a compromise.
(And you do need to memorize your password manager password - and your main email account password as well)
Also a lot of leaked passwords were strong, they just got compromised because someone didn't know about 70's password security basics.
Should we just never use any leaked password ever again? (Note I'm not saying: with the same login - or any of the "top 100") Should we really trust all of our passwords to one service that might get compromised or just go away?
Should we bother creating a strong unique password for that new cool SF startup that doesn't know how to use bcrypt?
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#85When I feel like a security goon's arbitrary and capricious password policy is irrational and counterproductive, I make my passwords worse in the hopes that I have to someday read it to someone, or perhaps it gets spilt outin the open, and then everyone will see how forcing me to pick a password that adheres to certain characteristics solved nothing. Just wait. Someday you will see dumps of pwnt password that look li…
I completely agree. "Your password must be at least 10 character long, include 2 upper case, 2 lower case, 2 digits, 2 special characters, must be changed every 60 days and cannot be reused for the next 3 years" G0Fuc4Y@urse!f To me this is a sure way that people are gonna pick horrible and stupid passwords.
And leave them in a post-it glued to their monitor
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#86Aside from the thought that a portion of these bad passwords may be for throwaway accounts, I think what we really need is a "Beyond Passwords" movement similar to the push for Let's Encrypt.
I use KeePass 2.x on my laptop and it's been great for having complex passwords, but the few seconds it consumes to load it up every time just to log into a site is annoying. Worth the trade off, of course, but can't we do better?
Browsers, operating systems, and sites need to cooperate on making password managers as low-friction as possible. Once that's done, it's time to explore other options for users, like dongles (Yubikey?) or those "no password login" mechanisms like what Mozilla was running with Persona. Sad they discontinued that.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#87My biggest bugbear is with the really important sites like Apple and Google who force you to type out your passwords several times a day when using their services. I really want to pick a long complex password, but not if I have to keep typing it into login screens or pop-up windows where password managers don't work. Microsoft is doing a lot of good things in this area with passwordless logins and asking for PIN cod…
TBH I want solutions that work for all logins, not just a select few.
We need the OS makers (e.g. Apple, Microsoft, Google) to create a standard protocol for login windows that apps like 1Password, LastPass, Dashlane, etc can use. We kind of have it on iOS but not all app makers got the memo. Although I fear that they'll end up pushing for their own managers, taking business away from the password managers that are saving us.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#8886% of my passwords are for low consequence sites. How much should I care if someone hacks my handle and posts ads on a chat site? Or reads registration-required articles under my registration? Or etc etc.
'Security' is some kind of religion in tech circles. I don't know if it is just that risk analysis isn't part of your standard tech education, or if they think it makes them look cool to talk about always using 200 character hardware-RNG generated passphrases when ordering pizza online, or what exactly, but they're everywhere.
Seconded
The usual cargo-cult thinking usually ends up with someone leaving their 1024 bit secret key under the doormat, or worrying too much about nation states hacking your routers instead of worrying about Bob clicking a suspicious link.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#8986% of my passwords are for low consequence sites. How much should I care if someone hacks my handle and posts ads on a chat site? Or reads registration-required articles under my registration? Or etc etc.
'Security' is some kind of religion in tech circles. I don't know if it is just that risk analysis isn't part of your standard tech education, or if they think it makes them look cool to talk about always using 200 character hardware-RNG generated passphrases when ordering pizza online, or what exactly, but they're everywhere.
Yeah some people I know go OTT and use password managers for everything. To the point that they don't trust any cloud based ones so if they want to log in to something and they haven't got an up-to-date copy of their password manager db on them, they can't.
My system is two or three "disposable" passwords I use on low reputation sites or sites where I don't care about breaches. I don't care about people knowing it either, if someone asks and I trust them I'll more often than not tell them what it is. Services where compromise would actually affect me get stronger passwords: my Google and Amazon passwords semi-random generated, but sticks to a format so I change parts of it and never forget it, and I check to make sure it's not in breaches every now and again. I use variations of it for my bank, medical stuff, etc where a breach could actually have implications for me.
Re: 86% of CrashCrate subscribers used passwords already leaked in other breaches
#90Earlier quoted context omitted.
I completely agree. "Your password must be at least 10 character long, include 2 upper case, 2 lower case, 2 digits, 2 special characters, must be changed every 60 days and cannot be reused for the next 3 years" G0Fuc4Y@urse!f To me this is a sure way that people are gonna pick horrible and stupid passwords.
And leave them in a post-it glued to their monitor
Depending on your threat model, a strong password that is written on a piece of paper on your desk might beat a weaker password that's memorized. That would at least require physical presence of the attacker and if your desk is reasonably secured, that might be ok for a lot of cases.