4 ms·

I'm a little surprised he doesn't share actual password lists with at least some other security researchers. I get there are legal issues involved but I thought

I'm a little surprised he doesn't share actual password lists with at least some other security researchers. I get there are legal issues involved but I thought researchers had legal protections? "Dark web" (lol) hackers are already going to be circulating the sources of this list and in any case could probably crack sha-1 reasonably quickly. So if you do a minimal amount of verifying the person who asks (e.g. ring their university) you can surely help the good guys with little risk of misuse?

kasey_junk 9y ago
https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
- ChrisSD 9y ago
  They're SHA-1 hashes.
  - jacquesm 9y ago
    Two comments ago, you: > in any case could probably crack sha-1 reasonably quickly. So that shouldn't bother you then.
    - ChrisSD 9y ago
      As I said, that shouldn't bother crackers. It does bother security researchers who have much less in the way of resources.
    - SquareWheel 9y ago
      There's half a billion hashes. I don't see how anybody could crack them "reasonably quickly".
      - ChrisSD 9y ago
        Most of them will be known already. It's mostly just a matter of comparing hashes or at worst converting plaintext SHA-1 (which is designed to be very fast). And crackers will share unknown hashes to be cracked. So they can crowd source cracking far more effectively than the security community can.
        jacquesm 9y ago
        That suggests the security community is less organized and has fewer resources than the crackers.
        zbentley 9y ago
        > That suggests the security community is less organized and has fewer resources than the crackers. That suggestion likely reflects reality.
      - petee 9y ago
        In addition, the list isn't connected with any specific accounts* - even if you broke the whole list (which it essentially is already, anyway) someone would have to match each one to some rando account. Not likely. *unless you have the original breach, then we are back at zero: its already compromised.
        ChrisSD 9y ago
        Well exactly. It's of minimal (if any) use to crackers. But analysing cracked passwords could be of use for research.
      - 3pt14159 9y ago
        500m salt-free hashes just mean your odds of getting a hit per hash go way, way, way up. Around one in 2.9e39 instead of 1.5e48.
sugerman 9y ago
He recently shared Pwned Passwords which lets you check if your password is in the breached data. 1Password then did a POC integration into their service so you can test if your password shows up in HIBP data. https://blog.agilebits.com/2018/02/22/finding-pwned-passwords-with-1password/ https://blog.agilebits.com/2018/02/22/finding-pwned-password...
- ChrisSD 9y ago
  Right but that's not so useful for security researches. Analysis of the actual passwords would be more useful.
  - petee 9y ago
    His reasons: https://www.troyhunt.com/no-i-cannot-share-data-breaches-with-you/ https://www.troyhunt.com/no-i-cannot-share-data-breaches-wit... https://www.troyhunt.com/here-are-all-the-reasons-i-dont-make-passwords-available-via-have-i-been-pwned/ https://www.troyhunt.com/here-are-all-the-reasons-i-dont-mak...
    - ChrisSD 9y ago
      Indeed. I guess the best practical argument is sharing them securely is hard. Which is very true. However if it's not possible for two security researchers to exchange data then what hope is there for the rest of us? I get he doesn't want to do that and that is his prerogative. However, it does feel like we're so scared of things falling into the wrong hands that we hobble our ability to defend against hacks in the first place.
      - petee 9y ago
        I would imagine if there are any security researchers he trusts sharing the data with, they wouldn't need to email him out of the blue for it, nor need to discuss it with the rest of us. But no, there is likely no hope, lol

kasey_junk 9y ago

https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords

ChrisSD 9y ago
They're SHA-1 hashes.
- jacquesm 9y ago
  Two comments ago, you: > in any case could probably crack sha-1 reasonably quickly. So that shouldn't bother you then.
  - ChrisSD 9y ago
    As I said, that shouldn't bother crackers. It does bother security researchers who have much less in the way of resources.
  - SquareWheel 9y ago
    There's half a billion hashes. I don't see how anybody could crack them "reasonably quickly".
    - ChrisSD 9y ago
      Most of them will be known already. It's mostly just a matter of comparing hashes or at worst converting plaintext SHA-1 (which is designed to be very fast). And crackers will share unknown hashes to be cracked. So they can crowd source cracking far more effectively than the security community can.
      - jacquesm 9y ago
        That suggests the security community is less organized and has fewer resources than the crackers.
        zbentley 9y ago
        > That suggests the security community is less organized and has fewer resources than the crackers. That suggestion likely reflects reality.
    - petee 9y ago
      In addition, the list isn't connected with any specific accounts* - even if you broke the whole list (which it essentially is already, anyway) someone would have to match each one to some rando account. Not likely. *unless you have the original breach, then we are back at zero: its already compromised.
      - ChrisSD 9y ago
        Well exactly. It's of minimal (if any) use to crackers. But analysing cracked passwords could be of use for research.
    - 3pt14159 9y ago
      500m salt-free hashes just mean your odds of getting a hit per hash go way, way, way up. Around one in 2.9e39 instead of 1.5e48.

sugerman 9y ago

He recently shared Pwned Passwords which lets you check if your password is in the breached data. 1Password then did a POC integration into their service so you can test if your password shows up in HIBP data. https://blog.agilebits.com/2018/02/22/finding-pwned-passwords-with-1password/ https://blog.agilebits.com/2018/02/22/finding-pwned-password...

ChrisSD 9y ago
Right but that's not so useful for security researches. Analysis of the actual passwords would be more useful.
- petee 9y ago
  His reasons: https://www.troyhunt.com/no-i-cannot-share-data-breaches-with-you/ https://www.troyhunt.com/no-i-cannot-share-data-breaches-wit... https://www.troyhunt.com/here-are-all-the-reasons-i-dont-make-passwords-available-via-have-i-been-pwned/ https://www.troyhunt.com/here-are-all-the-reasons-i-dont-mak...
  - ChrisSD 9y ago
    Indeed. I guess the best practical argument is sharing them securely is hard. Which is very true. However if it's not possible for two security researchers to exchange data then what hope is there for the rest of us? I get he doesn't want to do that and that is his prerogative. However, it does feel like we're so scared of things falling into the wrong hands that we hobble our ability to defend against hacks in the first place.
    - petee 9y ago
      I would imagine if there are any security researchers he trusts sharing the data with, they wouldn't need to email him out of the blue for it, nor need to discuss it with the rest of us. But no, there is likely no hope, lol