15 ms·
86% of CrashCrate subscribers used passwords already leaked in other breaches
- 1ba9115454 9y agoIf you're responsible for running a website, how are you going to be resilient against attackers who come to your site with legitimate usernames and passwords of your members? One way is to email the user when they log in from a new device or computer. They then have to enter a 6 digit one time password from the email. Someone who grabs the users email and password from a breach would also need access to their email.
- Krisor103 9y agoAlso if someone attempts to change an email address linked with an account, an email could be sent asking for confirmation. 2FA is also becoming easier to implement for low level developers with Authy and Google Authenticator offering simple to follow boilerplates and documentation. Validation algorithm that forces a dictionary attack on password before successful registration could also be prudent. Just like SQL injection and query prepare statements, issues are very much known but it's the want and need to act on them. GDPR should start to help this, but management tier individuals who push development time scales are also needing to be 'sold' the importance of this.
- iliis 9y agoNo, please don't. This is arduous for those of us who like a bit of privacy and regularly clear their cookies etc.
- ptaipale 9y agoI guess this isn't typically based on cookies but device/browser fingerprinting.
- iliis 9y agoWhich is exactly what I'm trying to avoid. I don't want to be tracked so I try to limit the amount of fingerprinting possible.
- ptaipale 9y agoBut for this it is probably good that the services do fingerprint us - so that we understand how well it can work. Otherwise we'd assume that cleaning cookies is enough and wouldn't know how well that tracking works, not only when services that we knowingly use are doing it, but also when some actual black hats do it.
- Dylan16807 9y agoWhy not whitelist the cookies of sites where you're going to log right back in?
- jakecopp 9y agoFirefox Containers work great for this!
- packet_nerd 9y agoI second Firefox Containers.. very useful feature.
- iliis 9y agoThat's actually a good idea! It doesn't work for Google or Facebook tough, or other services I explicitely don't log right back in.
- buro9 9y agoWhat I do is similar. I use auth0, and have it configured for passwordless use. If you have a Google Account or Microsoft Account then you can simply use the OIDC / OAuth flow and have those third parties that you trust identify you and handle the authentication... we only ask for an email as it's necessary for our service. Because it's only auth0 talking to the identity provider, Google and Microsoft don't actually get to see which site you're signing into. If you don't have those, then you can just use an email code. We email you a single-use expiring (15 minutes) code, you enter it and gain access. In this scenario email becomes your identity. I use private browsing for everything... this is a bit inconvenient as password managers cannot handle this email verification flow. But for me that's good... I want this level of security for myself, I want the service not to be storing passwords whilst also not permitting identity providers to know what I'm signing into.
- gnud 9y agoJust a side note: Password managers are not useless in private browsing. I use KeePass and Kee for firefox, and it works the same in private browsing as in "normal" browsing.
- giancarlostoro 9y agoThey meant getting a new login password emailed to you.
- buro9 9y agoI had edited to clarify, gnud was right in his reply as my original wasn't as clear.
- homero 9y agoThese people reuse passwords so logging into their email is the same.
- Pica_soO 9y agoThe truth is the password is just another failed security concept- because those that work, cant be remembered by the users. So ones security researches terrible, is a neurologists reasonable. The actually embarrassing part is that after years of research- we still do not have a alternative.
- peteretep 9y ago> because those that work, cant be remembered by the users Remind me what's wrong with "correct horse battery staple" again?
- imajes 9y agohttps://api.pwnedpasswords.com/pwnedpassword/correct%20horse%20battery%20staple https://api.pwnedpasswords.com/pwnedpassword/correct%20horse... == 2.
- Dylan16807 9y agoyou know what they mean
- desas 9y agoRemembering a unique one for every site is hard.
- majewsky 9y agoAgain, password managers. You can have a "correct horse battery staple"-type password for that.
- packet_nerd 9y agoPassword managers are a band-aid on a fundamentally flawed technology. They are what we have now, so (if your tech savvy) that's what you're using. But it's an absolute shame that this is where we're at. I'm optimistic about the FIDO standard as a password replacement. Exciting things happening in that space recently!
- iovrthoughtthis 9y agoI'm still not sure why most services don't default to just mailing you a one time, short lived login link.
- sametmax 9y agoBecause my password manager is faster than checking mail. Because spam. Because people change mails and may forget to let you know. Because bots scan emails and they are mostly in clear text.
- jacquesm 9y ago> Because bots scan emails and they are mostly in clear text. If the password reset email goes through the same route then this doesn't matter. It's essentially a 'password reset' with every login. And because they are short lived you'd expect that if they had been used already that there would be no re-use possible, which would mean the attacker would have to be super fast and the victim would immediately know they were under attack.
- sametmax 9y agoNo you would mostly use it for phishing.
- Freak_NL 9y agoAlso because I don't necessarily use the same email address for each site.
- dzdt 9y ago86% of my passwords are for low consequence sites. How much should I care if someone hacks my handle and posts ads on a chat site? Or reads registration-required articles under my registration? Or etc etc.
- majewsky 9y ago1. With a password manager, you don't have to think anymore if a site is high-consequence or low-consequence. 2. What kinds of websites that require a sign-in are actually low-consequence? I can't think of any from the top of my head, but that's probably because I'm pretty reluctant to sign up to new sites.
- Etheryte 9y agoTo be honest, the first one that comes to mind is HN. There is zero consequence if someone was to get a hold of my credentials here — I don't care about the score and I can still recover the bookmarks.
- asaph 9y agoWhat if the person that takes over the account posts messages that arouse the interest of authorities? Your IP addresses and other info are associated with the account.
- Bromskloss 9y agoAre you posting on Hacker News from your own IP address?!?! :-O
- Etheryte 9y agoI think this is a pseudo-problem in pretty much any country except for, perhaps, totalitarian regimes or similar. If any large body would take interest in the account seriously enough to get the associated IP, they would also automatically get the new account holder's IP and the clear correlation.
- 9y ago
- pasta 9y agoWhat about generating a password for the user of lets say 256 characters (like a private key)? Ofcourse this is not optimal, but I think this is more convenient than let say sending a login link via email.
- lifeisstillgood 9y agoAt bare minimum websites should use 2FA - a simple TOTP on any smartphone will do wonders. But, the issue is that 86% of all websites offer so little value that 86% of people would just not bother using the site if they had to do the 2FA dance each time. That is the fundamental problem here - not people reusing passwords, or password policies that break when encountering my password manager. It's not surprising people use rubbish passwords to access rubbish websites
- ryandrake 9y agoOut of curiosity, I just looked at the list of sites in my password manager, and at least 3/4 of them are sites that I shouldn't even need an account to use! Mostly online shopping sites the wouldn't let me checkout without an account and forums that wouldn't let me do some function without an account. If all online shops were required to let me buy something without creating an account, my "password footprint" would be about 1/2 of what it is.
- lifeisstillgood 9y agoI have 118 entries (which seems scary) and a quick scan shows me about 95% are not rubbish (I guess there is a selection process) and something like 2/3rds I have some kind of financial relationship (HMRC/VAT, paypal, phone provider) as well as a (small) number of stores (I think Jeff Bezos needs to be thanked for that) Overall I am surprised - I would be prepared to use 2FA for quite a lot of those (many I do). And if those sites mostly moved over to using OAuth with Google or a more privacy minded provider, yeah I would be fairly happy. In fact why does Apple not do OAuth2? They have the privacy-is-our-thing going for them (as opposed to Google / Facebook whose business model is selling my data). After that I guess its the UK government Gov.Verify for commercial users
- gsich 9y agoPlease not. I don't want to use a 2FA for every crappy website with a login, nor do I have my phone with me all the time. (optional is fine of course)
- z3t4 9y agoStop giving your users passwords to Troy Hunt! Eg. hash and salt them! But use a really slow hash. Lets say the hashing speed is one hash per second, then it would take trillion years to brute force the password "hello".
- Sir_Cmpwn 9y agoI don't think you understand how he gets ahold of these passwords. They're from dumps of leaked databases.
- sakarisson 9y agoI think parent's comment is telling people to store passwords in such a way that they won't be very useful if they are leaked.
- z3t4 9y agoExactly! A password "hash" function is an algorithm that will turn a password string into a seemingly random string. Where it's impossible to figure out what the password is - based on the output string from the hash function. And the hashed string is saved in the database instead of the password. When the user logins the database runs the hash function. eg "SELECT * FROM user WHERE pw = hash($pw_input)" For example my md5 hashed password is a8b767bb9cf0938dc7f40603f33987e5 Now hackers are smart and will generate a "rainbow table" of all possible words and their corresponding hash (try google the md5 hash above). But then we can "salt" the password by adding a random string that is unique to each user, and the rainbow table becomes useless. "SELECT * FROM user WHERE pw = hash(concat($pw_input, salt))" But hackers don't give up so easily. Using GPU's and dedicated hardware they can generate billions of hashes per second, so they will just "brute force" hash all possible words (dictionary and more) together with the salt. To counter this we use a slow hash function, a function that takes up to 100ms to run, and now the hacker can only brute force ten passwords per second! Meaning it will take years to find even a simple password. If we all start doing this: slow hash function + salt - then Troy Hunt wont have any more passwords! Sorry Troy! And also if users use long passwords with some special characters like !"#¤%&/()= for increased entropy, then it will be even harder for the hackers to brute force them. Using only numbers a five letter pasword has 10^5 combinations. Using only lowever case letters there's 28^5 combinations. Using upper and lower case plus special characters and numbers there's like 80^5=3 billion combinations. If we now increase the password length from five to ten characters there's now 80^10=ten Quintillion combinations. Cracking it with 10 hashes/per second would take 30 billion years. But if it was a fast hash lile any of the popular md5 or sha where you can have a few billion of hashes per second it would take "only" 30 years. Where as a password with only five letters would take less then a second to crack. Now you think 30 years is a lot, but then there's Moore's law, where number of transistors will double every second year, leading to increased compute power. So two years from now those 30 years would only be 15 years. And 20 years from now those 30 years will be only one year! Think of this when you use what was considered best practice in the 80's
- charDiversity 9y agoWhen I feel like a security goon's arbitrary and capricious password policy is irrational and counterproductive, I make my passwords worse in the hopes that I have to someday read it to someone, or perhaps it gets spilt outin the open, and then everyone will see how forcing me to pick a password that adheres to certain characteristics solved nothing. Just wait. Someday you will see dumps of pwnt password that look like: Password-1234 Password_1234 Password!1234 Password&1234 Password?1234 Password$1234 And that is rated as a "VERY STRONG" password. Have fun with your character diversity, and your 90 day password expiration rotation schemes. Go ahead and try to force me into a corner. I'm still picking terrible passwords and I'm picking especially terrible ones because someone out there is trying to pull my strings. Pull my strings. Make me more predictable within your little security policy world. See how that plays out.
- KajMagnus 9y agoI like this entropy based password strength checker: https://github.com/dropbox/zxcvbn https://github.com/dropbox/zxcvbn Here you can see that it realizes that all your passwords are weak: https://lowe.github.io/tryzxcvbn/ https://lowe.github.io/tryzxcvbn/ (it says: cracked in minutes, or seconds, in an offline attack) And it does this without requiring uppercase or symbols or numbers. It even understands that passwords like "qwerty" are trivially cracked – it looks at how far the keyboard keys are from each other. Among lots of other things.
- systemtest 9y agoI shamefully have to admit that I tried to logon to your (throw away) account using the list of passwords you supplied.
- jacquesm 9y agoUsername checks out I guess. You and 50 others.
- dudul 9y agoI completely agree. "Your password must be at least 10 character long, include 2 upper case, 2 lower case, 2 digits, 2 special characters, must be changed every 60 days and cannot be reused for the next 3 years" G0Fuc4Y@urse!f To me this is a sure way that people are gonna pick horrible and stupid passwords.
- ddtaylor 9y agoI'll grab the data and make some easy to use bloom filters so nobody has to rely on a third party API to send passwords to. I can make different filters for hashes grouped by count so that I can get a rough estimate of how exposed it is.
- wrongTroyHunt 9y agoSo, the idea here, is that eventually every 8 character string winds up in Troy's special little database, and because HE has it in HIS special database, it should be off limits? Hmmm... yesss... indeed.
- xupybd 9y agoMy hn username is a former password. After I committed it to memory it seemed a waste not to use it for something.
- utk4rsh 9y agoDoes it cover the statistics that 86% of the password are from random websites, signup pages that don't need to be simple.
- austincheney 9y agoMy preference is for long passwords that comprise a natural language sentence. They are easy to remember and hard to brute force once they are greater than 40 characters. You don't need any of these draconian password rules if the password is long enough.
- stevewillows 9y agobefore I got into a password manager, I resorted to song lyrics, capitalizing the first character, including a number and a symbol at the start. '#1I'm picking up good vibrations', for instance.
- Harvey-Specter 9y agoA tad off topic, which password manager would you recommend?
- edgan 9y agoIt isn't awesome, but the best all around one I have seen is LastPass.
- stevewillows 9y agoI started with LastPass, but switched to OnePassword when LP was acquired by LogMeIn. OnePassword (the standalone client) was great, but it didn't work with linux at the time. I ended up trying keepassxc for a time, but ultimately ended up with bitwarden, which has served me extremely well. BitWarden isn't as polished as OnePassword, but its not far off. Since its purely browser-based, it works with every OS.
- Ensorceled 9y agoThe depressing thing is that every new company I join has terrible password hygiene: shared accounts (even on services that don't force it), passwords reused on multiple services, terrible passwords, passwords emailed around, passwords in word docs that are emailed around ... If IT people can't get this right, it's impossible for the average person to EVER get this right. We need a better solution.
- 1timeaccount25 9y agoThis riles me up so I will rant. I've given up remembering passwords for important accounts and just use the 'forgot me password' button to auth through email. If your site or service doesn't have more than 100 million users, please don't require a password for my email. Let me log in with another trusted account (Google, Twitter, etc). I miss the days of oauth2 and the flexibility of authenticating small services.
- matte_black 9y agoNo thanks, it’s far better to handle your own user authentication and not depend on third parties.
- SmellyGeekBoy 9y agoExactly... What other data am I giving them access to by signing up with an account that's closely linked to my IRL identity?
- packet_nerd 9y agoAbsolutely no way. Google and a few other massive corporations already control way to much of my life, adding control over authentication of my online accounts is simply unacceptable. It'd be way more acceptable if it was an open standard and I could choose which trusted ID provider I wanted to use, but I've not seen it work like that so far.
- jmartrican 9y agoMy concern is with faulty code when checking this list. if (isPwInBlackList(propossedPw)) throw new Exception("Proppossed pw is in black list"); logger.info("Password {} is OK.", propposedPw); //<-- faulty code here
- moviuro 9y agoThis can't possibly hap... oh wait[0] [0] https://www.bleepingcomputer.com/news/security/github-accidentally-recorded-some-plaintext-passwords-in-its-internal-logs/ https://www.bleepingcomputer.com/news/security/github-accide... dated 2018-05-01
- amanzi 9y agoMy biggest bugbear is with the really important sites like Apple and Google who force you to type out your passwords several times a day when using their services. I really want to pick a long complex password, but not if I have to keep typing it into login screens or pop-up windows where password managers don't work. Microsoft is doing a lot of good things in this area with passwordless logins and asking for PIN codes instead of passwords. I wish Google and Apple would follow suit.
- bad_user 9y agoTBH I want solutions that work for all logins, not just a select few. We need the OS makers (e.g. Apple, Microsoft, Google) to create a standard protocol for login windows that apps like 1Password, LastPass, Dashlane, etc can use. We kind of have it on iOS but not all app makers got the memo. Although I fear that they'll end up pushing for their own managers, taking business away from the password managers that are saving us.
- londons_explore 9y agoGoogle only makes me login once per 90 days per device. And even that I believe is simply because they don't want me forgetting the password.
- chiefofgxbxl 9y agoAside from the thought that a portion of these bad passwords may be for throwaway accounts, I think what we really need is a "Beyond Passwords" movement similar to the push for Let's Encrypt. I use KeePass 2.x on my laptop and it's been great for having complex passwords, but the few seconds it consumes to load it up every time just to log into a site is annoying. Worth the trade off, of course, but can't we do better? Browsers, operating systems, and sites need to cooperate on making password managers as low-friction as possible. Once that's done, it's time to explore other options for users, like dongles (Yubikey?) or those "no password login" mechanisms like what Mozilla was running with Persona. Sad they discontinued that.
- moviuro 9y ago> I use KeePass 2.x on my laptop and it's been great for having complex passwords, but the few seconds it consumes to load it up every time just to log into a site is annoying. Worth the trade off, of course, but can't we do better? Keepass only takes 1-2 seconds to open the database. Once that's done, no more delay... Ctrl-Alt-K on Windows brings the window to focus, click on password entry, Ctrl-V and poof, auto-typed in!
- packet_nerd 9y agoFIDO 2.0 It's flexible and secure, and most of the major players are onboard with the standard. I use and love KeePassXC (as everyone should at this point), but passwords have too many fundamental problems to be the future. Yubikeys are nice, but don't fit everyone or everywhere. The FIDO standard is flexible enough so that it can use one or more of many different authentication factors, biometrics on your smart phone, secrets stored in the browser, PINs, Yubikeys, and others. https://fidoalliance.org/about/what-is-fido/ https://fidoalliance.org/about/what-is-fido/ Particularly exciting to me is W3C's recent standardization of the protocol. It's starting to take off!
- devit 9y agoLetting users choose passwords is the default behavior of websites, but it's incredibly dumb. Just generate a random password on the server side and tell the user to store it in their password manager or in a plain text file. Do not let users enter their own password under any circumstance. All password issues solved instantly (yeah, if the client is compromised the password is too, but the attacker can install a keylogger and accomplish the same task anyway). Plus it's much more user friendly, since the user just needs to follow instructions and is not required to somehow "invent" a password.
- moviuro 9y agoCan't possibly work. Everyone is going to have their own notebook for passwords, protected by rubber band. Yay. Also, I use a password manager on my machines (for websites I use privately: amazon, taxes, etc.), a different one at work (for corporate tools). I also use my own passwords + 2FA(if available) for things I use at both places (like my own gmail, HackerNews, etc.). Forcing users to remember/write down something is just a bad idea. Chances are your "reset password" feature will be DDoS-ed into oblivion by your legitimate users. Much better alternatives: * the Google push notification: [0]; * a YubiKey or similar U2F token [1]; * a way to turn my smartphone into an automated keyboard that holds my secrets. [0] https://www.howtogeek.com/260369/how-to-set-up-google%E2%80%99s-new-code-less-two-factor-authentication/ https://www.howtogeek.com/260369/how-to-set-up-google%E2%80%... [1] https://www.yubico.com/start/ https://www.yubico.com/start/
- zargon 9y agoThese arguments aren't convincing me. I still like devit's idea. > Can't possibly work. Everyone is going to have their own notebook for passwords, protected by rubber band. Yay. I don't consider this a bad thing per se. A notebook of secure passwords is a lot better than dictionary passwords. (Dictionary in the sense of a leaked password dictionary.) > Chances are your "reset password" feature will be DDoS-ed into oblivion by your legitimate users. I had a co-worker who, on most sites, set passwords by mashing the keyboard and then always logged in using the reset password functionality. I also don't see the problem with this.
- MarkMc 9y agoThe takeaway is that if your site handles highly sensitive data like financial or medical records and you allow users to login with just an email and a password, you are doing it wrong. Almost no bank website allows login with just email/password - there's always some extra field required such as a User ID with random characters, an account number, a PIN number or a code from a second device. The reason is simple: if the bank accepted just email/password there would be a lot more fraud and the bank would lose money.
- tatersolid 9y agoAll six of the (major) banks I use require username and password only. And four of those limit password length to less than 12 characters.
- MarkMc 9y agoI should have said 'extra information', not 'extra field'. A username with random characters like C85Y922 is clearly more secure than an email username. Of the 6 major banks you use how many have email address as the username?
- tatersolid 9y agoSome require a separate username crafted by the bank, but they are low entropy. Something like last name plus 2 digits. One is a clearly sequential integer of limited range. Usernames are not secrets and add no security by being kept secret. Just lengthen the damn password instead!
- Beltiras 9y agoI'm in the process of revamping a backend's password mechanism. After reading something like this I just want to adopt hardware keys or Google Authenticator INSTEAD of passwords.
- pier25 9y agoI created this little macOS free app for generating strong passwords called Key. https://itunes.apple.com/mx/app/key/id1348022074?l=en&mt=12 https://itunes.apple.com/mx/app/key/id1348022074?l=en&mt=12 Hope it is useful to someone.
- tmd83 9y agoDoes anyone know of good libraries to gauge password strength or find easy password. I'm conflicted between using all leaked password vs. simply excluding super popular and well known pattern. Not sure exactly what measure to take to stop easy password. The password crackers now recognizing so many patterns some of the big passwords can be very trivial and it can be hard to recognize those. I have found some libraries that seems to have the right idea but would love a recommendation of what are the best/easiest one specially if can find one in Java and is not overly convoluted. Also love recommendation of open source self hosted 2FA solution. Looking at the core process of TOTP and prompt based 2FA (public key crytography) there's seem to be no reason either cannot be implemented as a library. Am I incorrect in that assumption?
- yunruse 9y agoHave you tried zxcvbn [1]? It’s a pretty good heuristic, with common names and character replacement built in, alongside the ability to provide a custom dictionary with heavy weighting (eg your user’s names, email, address). [1] https://github.com/nulab/zxcvbn4j https://github.com/nulab/zxcvbn4j