3 ms·

I feel like sites should somehow preemptively disable passwords that have leaked publically. Is there a simple way for them to do so without downloading every l

by ikeboy 10y ago

I feel like sites should somehow preemptively disable passwords that have leaked publically. Is there a simple way for them to do so without downloading every leak themself? Is there a simple way for whitehats to help out? Whitehat means you can't test the site without their permission, but someone could have a database that they provide partial access to for sites without leaking and spreading it further themself? Here's an idea I just thought of: sites should have a standardized, secondary place to log in, where if the login is correct it automatically disables the password and requires a reset. "Report a compromised account", as it were. Anyone (or maybe specific whitehat groups) should have explicit permission to try any logins they want there: after all, if they succeed in logging in then the right thing happens and the account is locked. It's impossible to gain any illicit advantage from such access because any correct credentials are locked as soon as you try them. (Is this assumption robust?) So whitehats could then take lists and throw them against sites that implement this standard, but no attackers can gain from this. The only problem I see is that disabling rate limits would open you to DOS (also if multiple people use the same list, although better coordination would help solve that): maybe allow bulk uploads which take less bandwidth overall. Does this idea have any value?

anamexis 10y ago
have i been pwned has an API: https://haveibeenpwned.com/API/v2 https://haveibeenpwned.com/API/v2
- ikeboy 10y ago
  Doesn't help without passwords, which present some ethical problems with helping spread them especially from that site as he gets some dumps that aren't public. With my idea the people with the data would be able to directly shut down the accounts ethically. Maybe the proposal could also hash and salt the passwords before sending it to the site, which sounds even better for security and wouldn't be too much of a hassle for whitehats who want to help.
- bigiain 10y ago
  Troy doesn't (for very good reasons) keep the passwords or hashes from breaches - just the email address. That make his API not quite capable of doing what's proposed here - Github can't use Troy's HIBP API to detect whether a breach containing my email address included a password that authenticates with them. (And I'm not sure there's even a way to make that service without creating _way_ more security problems than it solves...)
  - ikeboy 10y ago
    Do you see any blatant security problems with my proposal? The biggest problem besides DOS is that it leaks passwords to the site, which may prevent this from being useful except to trusted sites. But that can be solved by hashing/salting before uploading to the site, as long as the site publicizes their salting method (which shouldn't present security concerns, right?)
riquito 10y ago
What if one or many "leak" on purpose tons of passwords? We end up forcing people to use password managers (or post-it)?
- ikeboy 10y ago
  If an adversary or potential adversary knows your password, there's a strong case to be made that it should be changed, at least for services that require strong security. I don't quite get your concern. Isn't that better than them getting their account hacked?
- ludamad 10y ago
  The password space is big. They could release trillions.
briandear 10y ago
AWS did that for me. They sent an email saying that my AWS password was the same as one found in a breech, so they reset my password proactively. "Hello, At Amazon we take your security and privacy very seriously. As part of our routine monitoring, we discovered a list of email addresses and passwords posted online. While the list was not Amazon-related, we know that many customers reuse their passwords on multiple websites. Since we believe your email addresses and passwords were on the list, we have assigned a temporary password to your Amazon.com account out of an abundance of caution."

by ikeboy 10y ago

anamexis 10y ago

have i been pwned has an API: https://haveibeenpwned.com/API/v2 https://haveibeenpwned.com/API/v2

ikeboy 10y ago
Doesn't help without passwords, which present some ethical problems with helping spread them especially from that site as he gets some dumps that aren't public. With my idea the people with the data would be able to directly shut down the accounts ethically. Maybe the proposal could also hash and salt the passwords before sending it to the site, which sounds even better for security and wouldn't be too much of a hassle for whitehats who want to help.
bigiain 10y ago
Troy doesn't (for very good reasons) keep the passwords or hashes from breaches - just the email address. That make his API not quite capable of doing what's proposed here - Github can't use Troy's HIBP API to detect whether a breach containing my email address included a password that authenticates with them. (And I'm not sure there's even a way to make that service without creating _way_ more security problems than it solves...)
- ikeboy 10y ago
  Do you see any blatant security problems with my proposal? The biggest problem besides DOS is that it leaks passwords to the site, which may prevent this from being useful except to trusted sites. But that can be solved by hashing/salting before uploading to the site, as long as the site publicizes their salting method (which shouldn't present security concerns, right?)

riquito 10y ago

What if one or many "leak" on purpose tons of passwords? We end up forcing people to use password managers (or post-it)?

ikeboy 10y ago
If an adversary or potential adversary knows your password, there's a strong case to be made that it should be changed, at least for services that require strong security. I don't quite get your concern. Isn't that better than them getting their account hacked?
ludamad 10y ago
The password space is big. They could release trillions.

briandear 10y ago

AWS did that for me. They sent an email saying that my AWS password was the same as one found in a breech, so they reset my password proactively. "Hello, At Amazon we take your security and privacy very seriously. As part of our routine monitoring, we discovered a list of email addresses and passwords posted online. While the list was not Amazon-related, we know that many customers reuse their passwords on multiple websites. Since we believe your email addresses and passwords were on the list, we have assigned a temporary password to your Amazon.com account out of an abundance of caution."