18 ms·
Show HN: Evilpass – A slightly evil password strength checker
- rootsudo 10y agoI like it. Evil enough. I'll steal the idea.
- dkokelley 10y agoI thought it was going to run the user through a wild goose chase of eccentric and varying password requirements. This was better.
- cmdrfred 10y agoSame here. From the source it checks Twitter, Github, Facebook, Reddit and Hacker News. This also might prove that email addresses as usernames is a bad idea.
- arihant 10y agoPeople generally tend to try and get same username on most websites they visit. Especially the ones using same pw everywhere. So in that sense email as UID ain't that bad.
- hyperpape 10y agoProbably, but the alternative isn't much better. Many people I know are "randomguy42" on dozens of different services, except for a few shady ones where they're "definitelynotrandomguy42".
- randomguy42 10y agoCrap.
- Achshar 10y agoStop. The green color gives it away anyways.
- lvh 10y agoThere are a lot fewer places where my e-mail address is the same than where "lvh" is the same.
- roryisok 10y agoWell now I want to see this too. Somebody make it!
- daxfohl 10y agoEvery corporate workplace I've worked at seems to have exactly this.
- therealdrag0 10y agoHere's a video about a prank like that: https://www.youtube.com/watch?v=OsXYwShRQwU https://www.youtube.com/watch?v=OsXYwShRQwU
- titanomachy 10y ago"Password must contain only lower case numbers" And the perfect reaction: "Ohhh, OK. Wait, what?"
- lvh 10y agoSo, let's talk about password requirements. The README suggests that instead of this, you should check entropy. That's a little tricky! Entropy in the traditional information-theoretic sense is a property of a random variable. You need to know what distribution a user drew it from. You can make educated guesses (e.g. if long, probably using password manager, if using password manager, probably fixed length) but that usually only tells you something useful about the _good_ passwords, and not the bad. You don't care about the good passwords. If the user entered "correct horse battery staple" but the user _always_ uses that password, a sufficiently informed attacker experiences 0 bits of entropy. So, entropy estimation is pretty bad, and we end up with imperfect password rules. Here are some ideas: 1. Make an educated guess about the distribution. Is it "correct horse battery staple"-like? Because then maybe don't tell people to add special characters if it's long enough. Relaxing requirements when people add numbers is tricky; turns out people are really likely to add those numbers at the end, and then it's probably a bad reused password like sparky1 or whatever. 2. Filter extremely common passwords, and things directly linked to usernames. 3. 8 <= len <= 70 or so (otherwise you'll get probably-bogus Hackeroni submissions about DoS). 4. No scheme will save your user from shitty passwords. bcrypt, scrypt, argon2, whatever -- not an excuse for not protecting your password database. 5. If you wanna be really fancy, use your guesstimate about the source distribution to produce an entropy estimation. Entropy is the nerd-proof answer, but most consumers don't know what it is. Whether or not telling users something like "try making your password longer" or adding a new class of special characters is friendly UX and whether that actually makes them use significantly better passwords versus the moral equivalent of sparky1 is an open question; I don't think it's an unreasonable assumption that both work out worse than you might hope. It's important to note that this doesn't need to be perfect (and strictly speaking, it can't be). You just need to stop non-advanced users from shooting themselves in the foot, and ideally prevent power users from being annoyed at your service. I should really turn this into a library :-) But before you do any of this fancy stuff? Implement 2FA, ideally U2F. No work you do on password rules is going to compare to what you get if you allow shitty passwords, but most of your users use U2F. Just get started now. I know U2F has limited distribution right now. That's a chicken or the egg problem. You can do TOTP too, but trust me, U2F is way, way better.
- chadaustin 10y ago
- taf2 10y agoMy favorite part of this is https://www.xkcd.com/792/ https://www.xkcd.com/792/
- weinzierl 10y agoJust out of curiosity: What happened in March 1997? A list of Historical Events in March 1997[1] shows nothing relevant. [1] http://www.onthisday.com/events/date/1997/march http://www.onthisday.com/events/date/1997/march
- bbcbasic 10y agohttps://www.explainxkcd.com/wiki/index.php/792:_Password_Reuse https://www.explainxkcd.com/wiki/index.php/792:_Password_Reu...
- averagewall 10y agoThe explanation on the XKCD page says: "This could possibly refer to the March 26, 1997 incident in San Diego, California, where 39 Heaven's Gate cultists committed mass suicide at their compound. It is a plausible explanation, since one of them was the brother of Nichelle Nichols (a Star Trek actress), so the event got a big resonance in nerd circles (and Randall often refers to Star Trek in xkcd). However, given Black Hat's strange behavior, it could be anything, even Bill Clinton banning federal funding for human cloning research."
- ekimekim 10y agoI always read that as http://tvtropes.org/pmwiki/pmwiki.php/Main/NoodleIncident http://tvtropes.org/pmwiki/pmwiki.php/Main/NoodleIncident (a purposely dangling reference because the viewer's imagination is more effective than anything you can say)
- agentgt 10y agoI'm starting to come of the opinion that systems should probably not let users pick their passwords. That is they get to pick a generated password (by the system) that is easy to remember. Maybe from 10 or so. There are password generators that use multiple words but are really long (eg you have probably seen the new router passwords that are like this). I have even thought maybe emojis might make for better passwords for some users.
- Daniel_Marcos 10y agoEmojis in passwords would both make passwords more secure and easier to remember for some people. The drawback is that they're very hard to enter in normal, physical keyboards.
- Swizec 10y agoMacs come with a built-in emoji keyboard. Cmd+ctrl+space But does it really improve security that much? If password is short, it's still gonna be quick to crack.
- teej 10y agoThere are ~1800 widely supported emojis. That blows out the search space. There are 10^19 possible passwords for a 6 character alphanum+emoji, the same as a 10 character password using just alphanum + simple keyboard symbols.
- eslaught 10y agoBut what's the actual distribution of usage of emoji? I'm guessing there is a small-ish set that people actually use, just like there is a small-ish set of words that people will pick from if you ask them to pick a passphrase containing "random" words. Unless you pick the passphrase for them, you're not really gaining the advantage of the search space size.
- MichaelGG 10y agoExcept people will probably stick to a few common ones and do a pattern. Love eyes x2 heart heart, thumbs up -- just like people don't pick words uniformly.
- bjt 10y agoAn actually-useful alternative: https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn
- rohannair 10y agoThe package size of that thing is ridiculous. Used it once in a React/Redux app and it was about the same size as everything else combined. Edit: 832kb apparently https://github.com/dropbox/zxcvbn/issues/169 https://github.com/dropbox/zxcvbn/issues/169
- smnscu 10y agoThis is naturally due to having large-ish dictionaries embedded: https://github.com/dropbox/zxcvbn/tree/master/data https://github.com/dropbox/zxcvbn/tree/master/data Some people in the thread you linked to recommend lazy loading, another idea would be to use a bloom filter – I used this in a project to check server-side for hashes of (MMs of) common passwords.
- TheAceOfHearts 10y agoIt's pretty gigantic, so lazy-loading it is pretty much a hard requirement. If you're using React/Redux, you probably have a build tool like Webpack setup, which makes loading async dependencies pretty painless.
- FabHK 10y agoExcuse me, it's less than one MB for actually useful (and rarely used) functionality, in a time when many websites routinely weigh in at several MegaBytes for tracking, advertisements, silly pictures and other cruft. It is very noble that you are concerned about page size (seriously, I frequently travel and am on awfully slow WiFi or mobile networks (remember GPRS and Edge?) and hate wasteful websites with a passion) - but I'd much rather you remove all the other cruft (seriously, how much can two fields for "Enter username and password" take?) and include the most excellent zxcvbn.
- Tostino 10y agoIf you want to use a server side tool, I wrote a port of it in Java (with quite a few extra features): https://github.com/GoSimpleLLC/nbvcxz https://github.com/GoSimpleLLC/nbvcxz At least on the server side, size doesn't matter quite as much.
- mikeash 10y agoThis is an interesting concept. It gets me thinking: what exactly makes this "slightly evil"? It's not actually doing anything nefarious. It checks to see if it can use your credentials to access certain sites, but it doesn't actually do anything with them besides tell you that it worked. There is of course the potential for doing nefarious things using your credentials on other sites. But... all software which receives a username and password has that potential. I can only conclude that it's "slightly evil" to point out the possibility.
- erik14th 10y agoIf you think long and carefully enough, you'll find out "evil" is just something that would offend or harm other people. Showing that you can log into someone else's account with info they provided you is like saying "dude, you stupid". And even though your intention is for them to take care of themselves, they will, instinctively take that as an aggression. Sure it's not as bad when it comes from a website, but I bet you know how people react when you try to teach them something they don't wanna learn.
- Drumlin 10y agoIt's hitting a load of third party services - for its own benefit - that were never intended for that purpose. I would hate to run a service and find some freely available script was letting anyone use it in an automated fashion. It's like what happened with the whois system and the catchas that providers had to add to prevent abuse from scripts.
- bayonetz 10y agoThis reminds me of something I've worried about from time to time. I have a fairly sophisticated password scheme from before there were good password managers. I don't have unique pass per site but close to it. I still forget sometimes which goes where and end up entering in real passwords just that are for other sites. There are probably a few sites at this point that have seen me enter in all my real (but wrong for that site) passwords. All some evil actor would have to do is keep a log of my attempts at one site and they could get pretty far with getting all my passwords. It's pretty scary.
- socialentp 10y agoThis is compared to the very evil password strength checker, which gives an ambiguous "password not strong enough" error until it finds a match with another service.
- anticafiamma 10y agoHave any bad actors even been implicated in this kind of abuse?? It'd be interesting to try to automate honeypots to screen for this -- for each suspect site, unique credentials which are also reused on honeypot accounts on other major common target sites.
- TheBobinator 10y agoOne of the fundamental problems is most developers dehumanize people by referring to them as users, which that term might as well be synonymous with robots given how developers think about them. This "slightly evil" approach is humorous, but in all candor, silicon valley has a serious disease of treating people like cattle and that's the kind of attitude that generates this kind of project. Of course, without respect for your customer base, you really can't have integrity or respect for yourself, which is why many of the jobs out there are so brutal. If the company doesn't respect it's customers, it doesn't respect itself, and it sure as heck isn't going to respect it's employee's. The biggest and most profitable technology companies in the US are not trustworthy due to this. At this point it's habitation and embedded so deeply into the thinking I'm not sure it'll ever change. There's a fundamental lack of respect for simplifying the whole ordeal of authenticating; do it in such a way someone would need to know exactly how the authentication works and what the risks are if they were scammed. E.G. First page listing what someone could do to you if they got your password so they can assess the risk. Second page indicates the requirements and gives some examples. Third page asks them how they want to manage recovery should they forget their password, and whether they want to be notified. Change the business risk or the password requirements? Update and put all the users through the whole process again.
- bbcbasic 10y agoI think this repo exists for ironic purposes. It does recommend not to use such a system to check passwords. I think it serves as a warning that any site could do this, so be careful. Furthermore (and more evil) is to record all user input into forms using Javascript so if you mistakenly enter another site's password and then realize your error - they have it anyway. Caveat Surfor
- elastic_church 10y agolol, this is hilarious I use so many different email address and usernames - along with a password manager - that I would undermine the usefulness of this project many times I also use a password manager for the username itself, completely random
- biot 10y agoEmail and username are transposed compared to the site check function signatures. I'm sure someone will send a pull request to fix that and make it slightly less un-evil. To be more specific: def _check_twitter(username, email, pw): Yet it's called in check_pass as: if checks[check](email, username, pw):
- jfroma 10y agoThis server-side call to Twitter, Facebook etc is a bad idea. I understand you are trying to educate your users with a nice UX but let's say this software is running on USA but the user trying to sign up is based on France, the attempt of login can trigger anomaly detection algorithms (eg: impossible travel) and the user might receive an email from Twitter "someone has login across the pond with your password, if is not you please change immediately". There are a lot of things that can be done though. Facebook and Netflix [1] for instance are crawling the web for leaks and pastes, once they find one of their user's password they will force the user to change their password. Auth0 is a authentication-as-a-service and we offer this as a feature [2]. I have worked on this feature and several related features, my advice is don't ask for a password in your public website. If you think is easy, you are wrong, it is a lot of work to code it correctly but it is also a lot of work maintaining the system. Brute force protection, anomaly detection, detecting when your user password has been leak by a third party, etc. It is simpler to authenticate by using a third party like google, you just have to be careful about implementing oauth flows correctly. DISCLAIMER: I work for Auth0. 1: http://www.dailymail.co.uk/sciencetech/article-3628950/Time-change-password-Facebook-Netflix-asking-users-tighten-account-security-following-major-breaches.html http://www.dailymail.co.uk/sciencetech/article-3628950/Time-... 2: https://auth0.com/blog/announcing-password-breach-detection/ https://auth0.com/blog/announcing-password-breach-detection/
- JshWright 10y ago> "someone has login across the pond with your password, if is not you please change immediately". Isn't that exactly what they should do though? They just Spicered their Twitter password...
- jfroma 10y agoYes, some websites will automatically block the attempt and further attempts, other will challenge the user with multifactor auth etc. Google is sending an email every time you login in a different OS or browser even if you are on the same city.
- 10y ago
- atmosx 10y agoI understand the rationale. This would upgrade the level of a security of any given website. I wonder... Can a third party launch a script testing my passwords without prior explicit authorisation? Could this trigger lawsuits/legal actions?
- andreareina 10y agoCould be actionable in the USA under CFAA. Consult a lawyer. Legality aside, actually using this is a bad idea all around.
- WildUtah 10y agoGreat. That covers the 0.01% of all crackers that live in the USA.
- penglish1 10y agoPlease change "password reuse is bad okay" to "password reuse is bad mmmmkay" Thank you.
- Spooky23 10y agoJust use diceware.
- malikNF 10y agoWouldn't doing something like this on a live site constitute as a social engineering hack? Hope the author of the projects leaves a very visible warning to anyone who might actually consider including something like this on their applications.
- sova 10y agoBy mere virtue of showcasing the irony in providing passwords and their re-use I must tip my hat to you. You have done more as a security activist with a simple project than most people do with 100 blog posts!
- jokoon 10y agoThis is a genius idea. In my opinion, facebook, twitter, google and others should work together to prevent their users to share a same password in their platform. It would be a win win. Of course I have really no idea how to implement such a thing securely, since government platforms would obviously try to peek at how it would be done.
- ezekg 10y agoMaybe I'm just grumpy, but I'm sick and tired of seeing 'joke' libraries like this. Not the kind of stuff I look for on HN and it's becoming more common.
- Schwolop 10y agoHere's a thought web devs. You know how your website has a 'reset my password' flow? How about you just use that on its own, and not have passwords at all? I recall one website I visit does this, but I can't remember which one.
- deleted 10y ago[deleted]