4 ms·

also there is no way to know if the usernames from the leaks are the same person as your own users. otherwise, you’re essentially saying that you have to pick a

also there is no way to know if the usernames from the leaks are the same person as your own users. otherwise, you’re essentially saying that you have to pick a unique password that nobody else in the world is using.

kazinator 3y ago
sn*wfl@ake1
- g-b-r 3y ago
  If you've got that out of a random password generator, beat yourself for not having bought a lottery ticket instead of generating a password
  - kazinator 3y ago
    Beat myself, rather than the author of that generator?
    - g-b-r 3y ago
      If the generator is really random, getting back such a simple password is definitely possible, but as unlikely as winning a lottery (ok maybe not one of the hardest ones)
feoren 3y ago
If everyone in the world were using 100 passwords, you'd need space for 800 billion passwords, which is 39.5 bits of entropy. Assuming an alphabet of 74 characters (lower + upper + digits + a few symbols), you'd need a little over 6 characters to make 800 billion unique passwords. A random password of 9 characters has a very low chance of overlapping any other password in the world: somewhere around Sqrt(74^9 / 74^6.2) ~= 0.2%. That's a 0.2% chance of overlapping any other password -- multiply that by the probability of having your password leaked for the chance that it's on the blacklist. Make it 10+ and you're fine.
g-b-r 3y ago
And what's controversial in picking a unique password that nobody else in the world is using? (and hasn't been leaked yet, actually)
- pompino 3y ago
  There is no way to know or verify what is or isn't a real leak, and what passwords are or aren't leaked. We can't settle this in the comments, and I think it's just security theater. 1. User x signs up for Service A using pwd abcd1234 2. User y signs up for Service B using pwd abcd1234 2. User z signs up for Service C using pwd abcd1234 Service A is breached. Users x,y,z get emails forcing a reset of their password. Users x,y,z reset their password to abcd1245 and all is good (among many other permutations). Now Service B is breached, rinse and repeat. Depending on the workflow (the more automated it is the worse off we are), there are security vectors to exploit here by doing a carefully planned fake 'leak' using mostly useless emails but only a few genuine emails to trigger pw resets, etc, etc.
  - g-b-r 3y ago
    I'm not sure what you're talking about, you definitely seem to have misconceptions about passwords, their math and services like haveibeenpwned. You seem to like simple passwords and think that people should use them so long as they're not leaked. Well no, simple passwords are never good; a probably very large number of the possible ones has already been the subject of some leak, and they're very risky in any case. Service providers (should) strive to give some protections even to users with bad passwords, but you sure can't rely on that.
    - pompino 3y ago
      Its easy to lose track of these complex topics. Anyway another day, another time maybe I can explain it better to you.

kazinator 3y ago

sn*wfl@ake1

g-b-r 3y ago
If you've got that out of a random password generator, beat yourself for not having bought a lottery ticket instead of generating a password
- kazinator 3y ago
  Beat myself, rather than the author of that generator?
  - g-b-r 3y ago
    If the generator is really random, getting back such a simple password is definitely possible, but as unlikely as winning a lottery (ok maybe not one of the hardest ones)

feoren 3y ago

If everyone in the world were using 100 passwords, you'd need space for 800 billion passwords, which is 39.5 bits of entropy. Assuming an alphabet of 74 characters (lower + upper + digits + a few symbols), you'd need a little over 6 characters to make 800 billion unique passwords. A random password of 9 characters has a very low chance of overlapping any other password in the world: somewhere around Sqrt(74^9 / 74^6.2) ~= 0.2%. That's a 0.2% chance of overlapping any other password -- multiply that by the probability of having your password leaked for the chance that it's on the blacklist. Make it 10+ and you're fine.

g-b-r 3y ago

And what's controversial in picking a unique password that nobody else in the world is using? (and hasn't been leaked yet, actually)

pompino 3y ago
There is no way to know or verify what is or isn't a real leak, and what passwords are or aren't leaked. We can't settle this in the comments, and I think it's just security theater. 1. User x signs up for Service A using pwd abcd1234 2. User y signs up for Service B using pwd abcd1234 2. User z signs up for Service C using pwd abcd1234 Service A is breached. Users x,y,z get emails forcing a reset of their password. Users x,y,z reset their password to abcd1245 and all is good (among many other permutations). Now Service B is breached, rinse and repeat. Depending on the workflow (the more automated it is the worse off we are), there are security vectors to exploit here by doing a carefully planned fake 'leak' using mostly useless emails but only a few genuine emails to trigger pw resets, etc, etc.
- g-b-r 3y ago
  I'm not sure what you're talking about, you definitely seem to have misconceptions about passwords, their math and services like haveibeenpwned. You seem to like simple passwords and think that people should use them so long as they're not leaked. Well no, simple passwords are never good; a probably very large number of the possible ones has already been the subject of some leak, and they're very risky in any case. Service providers (should) strive to give some protections even to users with bad passwords, but you sure can't rely on that.
  - pompino 3y ago
    Its easy to lose track of these complex topics. Anyway another day, another time maybe I can explain it better to you.