4 ms·
>“ 23andMe knew or should have known that many consumers use recycled passwords ” How would they know this?
by pompino 3y ago
>“ 23andMe knew or should have known that many consumers use recycled passwords ”
How would they know this?
- squigz 3y agoThere's at least 1 service [1] that allows checking previous data breaches for compromised emails/passwords. I imagine there's others, too. https://haveibeenpwned.com/API/v3 https://haveibeenpwned.com/API/v3
- deleted 3y ago[deleted]
- pompino 3y agoThere is no way to verify that the usernames from the leaks are the same person as your users.
- shermantanktop 3y agoHow could they not know this? This is common knowledge for anyone involved in online consumer security. And the correctness of this common knowledge is beyond dispute, with numerous publicly-known breaches traceable to this practice, as well as the development of scaled, repeatable attack methods associated with it. The only way they could have not known is if they failed to employ or consult with the appropriate professional expertise in this area.
- kazinator 3y agoNo, how would they know this for any given password? Gashibyu@gyoryana3: is that recycled, or freshly minted?
- pompino 3y agoalso there is no way to know if the usernames from the leaks are the same person as your own users. otherwise, you’re essentially saying that you have to pick a unique password that nobody else in the world is using.
- kazinator 3y agosn*wfl@ake1
- g-b-r 3y agoIf you've got that out of a random password generator, beat yourself for not having bought a lottery ticket instead of generating a password
- feoren 3y agoIf everyone in the world were using 100 passwords, you'd need space for 800 billion passwords, which is 39.5 bits of entropy. Assuming an alphabet of 74 characters (lower + upper + digits + a few symbols), you'd need a little over 6 characters to make 800 billion unique passwords. A random password of 9 characters has a very low chance of overlapping any other password in the world: somewhere around Sqrt(74^9 / 74^6.2) ~= 0.2%. That's a 0.2% chance of overlapping any other password -- multiply that by the probability of having your password leaked for the chance that it's on the blacklist. Make it 10+ and you're fine.
- g-b-r 3y agoAnd what's controversial in picking a unique password that nobody else in the world is using? (and hasn't been leaked yet, actually)
- 3y ago
- drdaeman 3y agohttps://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords > This password wasn't found in any of the Pwned Passwords loaded into Have I Been Pwned. That doesn't necessarily mean it's a good password, merely that it's not indexed on this site. But I doubt it's a common practice to do this kind of check.
- g-b-r 3y agoYeah it's sure not common yet but in a 2021 post Troy Hunt says it was already thousands: > literally thousands of other services doing everything from providing their own password checker through to checking their customers' passwords on every registration, login or password change to see if it's previously been breached (https://www.troyhunt.com/open-source-pwned-passwords-with-fbi-feed-and-225m-new-nca-passwords-is-now-live https://www.troyhunt.com/open-source-pwned-passwords-with-fb...)
- drdaeman 3y agoRight, but thousands is a minuscule number - there are myriads of services out there. While it would've been nice if 23andMe would've used a service like this, can't exactly blame them if they didn't - it's not like this is some well-established industry standard, but more like an extra effort by extra security-conscious companies.
- g-b-r 3y agoYes true What I'd blame 23andMe for, is having encouraged so much all that sharing of sensitive data with other accounts, without providing additional safeguards to access such data.
- kazinator 3y agoI don't think it's a good idea to depend on yet another third party domain in this way. The check has low value. HaveIBeenPwned only provides value when it positively informs about a pwned password, otherwise it says nothing useful. If you're already rejecting weak passwords using some heuristics, then the remaining passwords are unlikely to show up on that site, because, strong passwords are unlikely to be pwned, even if reused and subject to a breach.
- pompino 3y agoCan you decribe a mechanism to verify that users in an alleged leak are the same users as your own?
- shermantanktop 3y agoIs your user population large and unsophisticated? If "Yes," then you have shared users who are reusing passwords.
- pompino 3y agoCan you answer my question rather than your own, please? Otherwise we're just going in circles.
- shermantanktop 3y ago> Can you decribe a mechanism to verify that users in an alleged leak are the same users as your own? What I offered was the mechanism I would use to solve this problem, which is a probabilistic approach rather than a deterministic approach. What you described is likely infeasible and impossible, so rather than get blocked on that, I moved to an alternative angle.
- pompino 3y agoWhat is the mechanism? I don't see anything in the comment sorry. Maybe state it simply so I can follow along.
- shermantanktop 3y agoThere is no need for a mechanism in this case; building such a thing would be a waste of time. Honestly, I was trying to respond to your question, and perhaps I was too terse. But I don’t think the mechanism you ask for is possible (or desirable) today. In a future scenario with some type of universal identity there would probably be no need for such a mechanism.