6 ms·

The slightly annoying thing here is that I already use a password manager, so while the impact to me is minimal, I wish I knew which password specifically I hav

The slightly annoying thing here is that I already use a password manager, so while the impact to me is minimal, I wish I knew which password specifically I have to rotate, instead of assuming that I need to rotate, like, all of them...

jarfil 8y ago
What we may need is the next step: a standardized way of changing passwords that would allow us to rotate them in bulk directly from the password manager.
- Rychard 8y ago
  You might be interested in this, from just over a month ago: https://news.ycombinator.com/item?id=18618193 https://news.ycombinator.com/item?id=18618193
Groxx 8y ago
(Not affiliated with, just a happy user of) 1Password does a pretty good job at this, you can find all HIBP-passwords in a single location: https://support.1password.com/watchtower/ https://support.1password.com/watchtower/
shkkmo 8y ago
Why not use Pwned Passwords to check your passwords to see if any of them need to be rotated due to this breach or any other?
- sliken 8y ago
  Seems really weird to advocate people reveal their passwords to a random untrusted 3rd party. They do have an API that allows you to search for your password based on a truncated checksum, so you can find out if your password was leaked, without revealing the password.
  - deleted 8y ago
    [deleted]
  - bbernoulli 8y ago
    The password itself is not sent. You can read about it here: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...
    - sliken 8y ago
      He's suggesting using (the link is from your link): https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords Which does upload your password, which I think is an unacceptable risk.
      - rincebrain 8y ago
        You're either not reading the "how this protects your password" link that's on top of the page or claiming it's wrong. [1] It sends the first N characters of the SHA1 hash of the password you provided to the server, the server replies with all the hashes it knows with that prefix, and then the client-side JS compares it to the rest of the hash it has. If you don't believe me, you can look at the request said site issues for some arbitrary string - it's just the first 5 characters of the SHA1 hash, and the response from the server is as I (and that link) describe. [1] - https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...
        sliken 8y ago
        So you are trusting the HTML/CSS and javscript downloaded from troyhunt.com with your plaintext password? Not to mention various bits from cloudflare.com, and other places. There's some code that page uses: http://az416426.vo.msecnd.net/scripts/a/ai.0.js http://az416426.vo.msecnd.net/scripts/a/ai.0.js Note the lack of https. You are going to trust a page with that code with your important passwords? Sure it claims to anonymize it first, but most don't know enough code to verify it themselves. Much like trusting curl https://whatever.com https://whatever.com | sudo /bin/bash Crazy.
andrewmackrodt 8y ago
I'm not sure if you're a 1Password user (or whether your alternative supports similar functionality) but the former has a feature called Watchtower which then groups your compromised logins.
garaetjjte 8y ago
I just use diffirent email for each service, so I could identify leaks.

jarfil 8y ago

What we may need is the next step: a standardized way of changing passwords that would allow us to rotate them in bulk directly from the password manager.

Rychard 8y ago
You might be interested in this, from just over a month ago: https://news.ycombinator.com/item?id=18618193 https://news.ycombinator.com/item?id=18618193

Groxx 8y ago

(Not affiliated with, just a happy user of) 1Password does a pretty good job at this, you can find all HIBP-passwords in a single location: https://support.1password.com/watchtower/ https://support.1password.com/watchtower/

shkkmo 8y ago

Why not use Pwned Passwords to check your passwords to see if any of them need to be rotated due to this breach or any other?

sliken 8y ago
Seems really weird to advocate people reveal their passwords to a random untrusted 3rd party. They do have an API that allows you to search for your password based on a truncated checksum, so you can find out if your password was leaked, without revealing the password.
- deleted 8y ago
  [deleted]
- bbernoulli 8y ago
  The password itself is not sent. You can read about it here: https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/ https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...
  - sliken 8y ago
    He's suggesting using (the link is from your link): https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords Which does upload your password, which I think is an unacceptable risk.
    - rincebrain 8y ago
      You're either not reading the "how this protects your password" link that's on top of the page or claiming it's wrong. [1] It sends the first N characters of the SHA1 hash of the password you provided to the server, the server replies with all the hashes it knows with that prefix, and then the client-side JS compares it to the rest of the hash it has. If you don't believe me, you can look at the request said site issues for some arbitrary string - it's just the first 5 characters of the SHA1 hash, and the response from the server is as I (and that link) describe. [1] - https://www.troyhunt.com/ive-just-launched-pwned-passwords-version-2/#cloudflareprivacyandkanonymity https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...
      - sliken 8y ago
        So you are trusting the HTML/CSS and javscript downloaded from troyhunt.com with your plaintext password? Not to mention various bits from cloudflare.com, and other places. There's some code that page uses: http://az416426.vo.msecnd.net/scripts/a/ai.0.js http://az416426.vo.msecnd.net/scripts/a/ai.0.js Note the lack of https. You are going to trust a page with that code with your important passwords? Sure it claims to anonymize it first, but most don't know enough code to verify it themselves. Much like trusting curl https://whatever.com https://whatever.com | sudo /bin/bash Crazy.

andrewmackrodt 8y ago

I'm not sure if you're a 1Password user (or whether your alternative supports similar functionality) but the former has a feature called Watchtower which then groups your compromised logins.

garaetjjte 8y ago

I just use diffirent email for each service, so I could identify leaks.