14 ms·
The Naz.API Credential Stuffing List
- deleted 3y ago[deleted]
- infinitusJM 3y ago7 records for me that relate to two old data breeches - Dropbox and Last FM.
- lelanthran 3y agoThe HIBP database really should be open to the world, with the email being redacted. I would love to grep the list of 25m passwords to see if any of mine are in there. I don't particularly want to send my details to HIBP to check if I have been compromised.
- phpisthebest 3y agoYou can download the password hashes. https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords
- hennell 3y agoThey have a downloader for the hashed password list: https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader https://github.com/HaveIBeenPwned/PwnedPasswordsDownloader
- diggan 3y agoAny ideas what the final size on disk would be after downloading?
- oldprogrammer2 3y agoIt is 37 GB (I downloaded it yesterday).
- samstave 3y agoObligatory H2: Can you see if my passwd is in there ***?*
- bookofjoe 3y agoAsking for a friend
- denysvitali 3y agoLooks like hunter2 to me
- TacticalCoder 3y agoIs it 37 GB with these new 1/3rd of previously unknown passwords hashes added? So basically: did that DB grow from about 27 GB to 37 GB in the last few days?
- thesuitonym 3y agoWhy does this need to be an app? Why not just release the hashes?
- CodesInChaos 3y agoThe hashes are split into a million (2^20) files based on the first 20 bits (5 hex characters) of the hash. The downloader is just a convenient way to download them all. The urls are https://api.pwnedpasswords.com/range/00000 https://api.pwnedpasswords.com/range/00000 to .../FFFFF, downloadable via any http client.
- nighthawk454 3y agoThanks, TIL! Bet JDownloader can make quick work of that as well
- deleted 3y ago[deleted]
- rad_gruchalski 3y agoYou can just host it yourself: https://github.com/radekg/hibp https://github.com/radekg/hibp.
- justinclift 3y agoIt's a .NET application, so may be windows only. :/
- jimbobimbo 3y ago.NET 6+ is cross platform.
- justinclift 3y agoIsn't that just specific parts, rather than the whole thing?
- daveoc64 3y agoThe core of the .NET runtime is cross-platform. You do have the option to use platform-specific APIs or frameworks, which will make your app only work on that platform. In the case of this app, it doesn't use anything platform-specific, so it could run on Windows, Linux and macOS.
- deleted 3y ago[deleted]
- jjulius 3y agoAs mentioned in the article, the database has been uploaded with emails redacted to Troy's Pwned Password search on haveibeenpwned.
- fritzo 3y agoThey should offer a small Bloom filter for download.
- andrewla 3y agoIt's easy to check through their verification service if your passwords have been compromised. Hash your password locally $ echo -n fredflinstone | shasum 95e47d937e105fa1cc84bfa476b10f091304c090 - Then take the first five characters of the hash and invoke the API $ curl https://api.pwnedpasswords.com/range/95e47 ... D8F3BA8D3952AA8917C78295EE1122F675C:17 D910D224A8450006478ED28D2CE2D005343:10 D91C102088F1D91469B803235DB60903259:874 D937E105FA1CC84BFA476B10F091304C090:290 D96BF2796784C142392D8B46AEF68B991D0:4 D98009835A90E46EFFD43AC3E5C6BD1C14B:5 And there we have it -- my password is compromised (the suffix D937...) Easy enough to script this up with minimal information leakage. All you're sending is 20 bits; that's not enough to do anything malicious even if your password is compromised.
- sambazi 3y agoadd two spaces right before the echo to avoid logging your secrets in the shell history
- andrewla 3y agoOr better, just do a `(read -s asdf; echo -n $asdf | shasum)` to create a temporary subshell and never even expose your password in the shell output.
- sambazi 3y agowill create interesting errors with certain characters
- mzs 3y ago% head -1 | tr -d \\n | shasum Type your username and press the RETURN key.
- codetrotter 3y agoOne space is sufficient in bash, if memory serves right. And secondly, on macOS with the default config for zsh no amount of spaces will help, I think. You have to first configure zsh to ignore from history when starting with space. And after that I think one space will be enough.
- freitzkriesler2 3y agoUgh I have a smattering of accounts that use the same password before I wised up and started using a generator. My important accounts are secure by 2fa however and a strong password. One day I'll sit down and just go through them all to fix them. Maybe just pay for wifi on a flight and clean it up.
- diggan 3y ago> One day I'll sit down and just go through them all to fix them. Maybe just pay for wifi on a flight and clean it up. Maybe do it while being connected to a network that isn't infamous for its poor security :)
- CoastalCoder 3y agoI'm not super educated on security stuff, but would airplane wifi add any significant risk? I'd think that as long as your laptop isn't already compromised, and you don't need to use someone's proxy server, HTTPS would be secure enough. I.e., no worse than doing it from home.
- r1ch 3y agoThe biggest risk is random mobile apps that disable HTTPS certificate checking, run APIs over plain HTTP, etc. On public Wi-Fi, anyone physically near you can intercept or snoop on that traffic. Browsers generally do a good job of ensuring HTTPS these days, but still you should pay attention to make sure you're on HTTPS when using public Wi-Fi.
- andreareina 3y agoHTTPS fixes that
- djbusby 3y agoMy password tool shows me which are oldest. So, quarterly (on tax day) I also make sure to change a few of them.
- fr3nzy4x 3y agoI had received an email from haveibeenpwned yesterday and just got into looking into this after reading through literally every comment on this forum im thinking that this is a breach that covers over a bunch of other breaches the "Polish Credentials" Data breach is the only other one ive been in and the password associated with that is the only one that appears to be in a breach and my new one has yet to come back as breached im not even from poland but was still compromised in that breach due to malware that was trying to blackmail me with somthing they didnt have and if you want to see what password was taken with the new breach use https://search.0t.rocks/ https://search.0t.rocks/
- fr3nzy4x 3y agoalso the screenshot in Troy Hunts post shows an account on the craxpro hacking website which i do have a account on with a temp password so if its that site breached i would check that out
- TacticalCoder 3y agoAnybody runs the HIBP password DB locally? (ideally with this latest treasure trove) I saw some converted it to a Bloom filter (which makes lots of sense: for all the passwords on which it answers 'definitely not in set', you know there's no false positive and in case it'd answer 'potentially in set' you could still query manually against the online DB). I'll search online but if a fellow HNer runs it offline, I'm all ears... P.S: I've got Gbit/s FTTH as well as servers in datacenters so downloading tens of gigabytes ain't an issue
- aaronax 3y agoIt is only tens of gigabytes, no need for fiber to handle this. The 37GB of files can be downloaded in 1 hour on an 83mbps link. (1gbps is 450GB/hour, useful for estimating things)
- myself248 3y agoMy favorite rule of thumb is that 100Mbps is about 1TB/day.
- tylerchr 3y agoI wrote a thing for this back when you could download the whole hash database as a single torrent, but I haven’t checked it since they moved over to the PwnedPasswordsDownloader system. This doesn’t use any probabilistic data structures though, it just packs the database into the smallest binary file I could come up with. https://github.com/tylerchr/pwnedpass https://github.com/tylerchr/pwnedpass
- andrewla 3y agoCurious about your use case; using their online service [1] is up-to-date and reveals almost no information. [1] https://news.ycombinator.com/item?id=39044339 https://news.ycombinator.com/item?id=39044339
- lorenzbrun 3y agoI have a project which acts as a local cache for the HIBP database. https://github.com/lorenz/hibp-cached https://github.com/lorenz/hibp-cached It downloads and continually updates from the upstream database while serving the identical API. On a fast link it can download the entire thing in a few hours. It just uses a giant BoltDB file to store compressed chunks.
- ttul 3y agoOn a positive note, I am seeing more sites offering Passkeys, which integrate natively with browsers and provide vastly superior security compared with passwords. We won’t ever eliminate the human error that leads to password theft. At least Passkey offers a way for your computer to securely authenticate a web site and for them to authenticate you in a way that cannot be stolen by a third party, because the credential doesn’t exist in a part of your computer that can be read by local programs.
- jl2718 3y agoLet’s recap the problem: Passwords don’t work because people can’t remember very much. Password generators don’t work because they have to store the key somewhere. Might as well just authenticate with the encryption key. Encryption keys often get lost, so they need to be stored in the cloud, accessible with a password, which brings us back to the first problem, but adds another point of exploit, or ‘lawful intercept’. Phone number second factor doesn’t work because that can be stolen or transferred, and the same device is probably used for password reset. Authenticator apps don’t work because devices can be stolen, and they require a password anyway to transfer to a new device. Biometrics don’t work because they can be cloned, or used on an incapacitated person, and in the case of phone biometrics, they can be overridden with a pin. FiDO devices don’t work because they can be lost or stolen and used by someone else. Social recovery doesn’t work because of moral hazard and probably the only people you trust that much are not particularly savvy with security around this kind of thing. Practically in an app, they would also have to authenticate in some technical manner, so this cascades. What have I missed?
- laeri 3y agoFIDO/physical keys still work and they are still the best solution. Sure they can be stolen but physical access is much harder to get than digital access. The loss problem is also practically not of importance as a backup key can mitigate this. Also physical loss does not guarantee access to the new owner as they need to know which identity uses the key as well as the password as the key is only the second factor. Best solution would probably be an implant of the physical key which makes it nearly impossible to lose it (apart from the worst case scenario).
- nosefurhairdo 3y agoBitwarden + 2 yubikeys is my solution. I remember one password, keep one key with me, and leave one key at home.
- bloopernova 3y agoIs there a "create duplicate/backup of yubikey" app of some kind? EDIT: How to register your spare Yubikey: https://support.yubico.com/hc/en-us/articles/360021919459 https://support.yubico.com/hc/en-us/articles/360021919459
- aimor 3y agoWhy has authentication moved away from making passwords safer? I like to imagine a system where the only thing that ever sees my easy-to-remember password is the browser, everything downstream gets a unique client-side hash. We did this manually in the past with various schemes, we do this today with extra steps using password managers, why aren't browsers simplifying this? (or maybe they are?) My understanding is that these schemes (say, hash your password with the domain name) are vulnerable with enough samples, but it's still better than sending your easy-to-remember password out to the internet. The answers I hear online are that there's no value added since everyone should use unique passwords to begin with, but people don't do this because it's extra work even using a password manager is extra work, the default needs to be more secure.
- bombcar 3y agoBecause 2fa lets password breaches be blamed on the user.
- verisimi 3y agoYou trust your browser?
- maxwellg 3y agoMy take on client-side hashing schemes is that they help with raising the floor - - they ensure that the backend application never sees your password in plaintext , and prevent the worst case scenario of a plaintext data dump - password hashing is CPU intensive by design, and pushing that work to the client means you can have them do the work and increase # of iterations far more aggressively but fundamentally still leaves users vulnerable compared to other approaches. For example, client-side hashed passwords can still be phished, and are not domain-bound like Passkeys are.
- xg15 3y agoI think with the "X can be phished" argument, there is a massive tradeoff to keep in mind: Everything where you as a user have direct access to the key can in theory be phished. So the only way to make credentials unphishable is by hiding the key from yourself and entrusting it to a third party, in the way that passkeys work. However, now you're entirely dependant on that third party. The question is if, everything considered, this is really such a big security improvement for you. I think an alternative approach would be to accept a certain risk that credentials can be stolen and improve the ways in which stolen credentials can be revoked.
- username135 3y agoKeepass + cloud drive for storage. Easiest, safest solution, imo. Your very own personal database of passwords for everything. Takes a bit to set up but once your done, you're done. I believe they even use this at nasa/jpl.
- sabjan 3y agohow do you view the *** password as text? It shows my account appeared in the hack any the password was p**k I don’t remember ever using a password with P and K, curious how I can view what is being the **
- derwiki 3y agoEven though I use a different password for each service, I have no idea which service's password was compromised because my "main" gmail was included in this breach. Do I need to use https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords to manually test each password I have saved with that email?
- tourmalinetaco 3y agoThis is one of a few reasons I have started to use email forwarders such as AnonAddy. https://github.com/anonaddy/anonaddy https://github.com/anonaddy/anonaddy Not all of my emails have been moved over yet, but over time I plan on depreciating almost if not all of my main emails from logins.
- derwiki 3y agoThe majority of my accounts are through a custom domain with a different username for each service. But that also means I don't have HIBP alerts set up for any of them.
- blowfish721 3y agoI have the same setup by the sound of it and set up HIBP to let me know whenever any email using my domain appears in the database.
- MyNameIs_Hacker 3y agoSame here. I call them canary email addresses when I have to describe it to someone, so I can tell when that organization loses its data. For those of us crazy enough to do this, I came up with another type of canary, a "Do they check for compromised passwords?" canary. I have an old password that used to be strong enough for sites I considered low value and was too lazy to break out the password safe. Of course at least one of those low value sites was compromised and that password was leaked. Now some of the services are high value to others while they remain low value to me. So they have enabled MFA and notifications when someone logs in. Since no one knows the email address I'm using and I've turned on MFA, I feel safe enough leaving that old compromised password in place. I'm waiting for the day they force me to reset it because they bothered to check their customer's existing passwords against compromised ones.
- mdrzn 3y agoThe comments on Troy's website seems to agree with our general sentiment: "There is really nothing actionable with this notification. Would be nice to at least know which service(s) were associated with my email."
- twisteriffic 3y agoTroy's response: > Think through what would mean: we’d have to sit on billions of plain text passwords (among other personal info) and return that visitors with no more validation than control of a single email address. The risk is huge, both to us and people in breaches. His stance is reasonable.
- 00deadbeef 3y agoI don't entirely agree it's reasonable. This dump apparently contains the source of the email+password combo. You can go on his website and look up sources of leaks with just an email address. That's what people really want to know: what was the source? So yes sifting through billions of records will take a while, but it's possible, but telling the user the source of the details (and not the leaked passwords themselves) is exactly what his website mostly already does so it's not a risk.
- haswell 3y agoThe risk is not in sifting through billions of records. The risk is enabling a service that unlocks a capability like “give me the password for this email address that may or may not be mine”. The source of a breach is a single attribute that can be associated with an entire dataset, unlike passwords.
- 00deadbeef 3y agoBut I'm saying it should be possible to view the source of the password, not the password itself. Which is what his site already shows for individual breaches.
- silent_kyblik 3y agoLooks like Seagate NAS software, see https://www.reddit.com/r/computerviruses/comments/189e0j9/comment/kiaavc6/?utm_source=share&utm_medium=web2x&context=3 https://www.reddit.com/r/computerviruses/comments/189e0j9/co...
- Demonsult 3y agoInteresting. I'm in the breach but never knowingly used that software, so it's likely buried under some other product or service.
- silent_kyblik 3y agoMe neither, all I had was Western Digital MyCloud NAS years ago, but nothing from Seagate
- great_psy 3y agoI also had a western digital nas that got bricked by a software update. And I am also on the nas.api list.
- upon_drumhead 3y agoI’m relatively certain I never used that software with the email that showed up on the breach warning :(
- toomuchtodo 3y ago> Edit: Fount it. It’s a Seagate NAS operating system. As in Network Attached Storage. NAS.api is their API. So I think someone(s) was using Seagate NAS equipment and the API was insecure. Appears that Seagate is to blame for making an API that has some vulnerabilities https://www.cvedetails.com/vulnerability-list/vendor_id-11967/Seagate.html https://www.cvedetails.com/vulnerability-list/vendor_id-1196...
- 00deadbeef 3y agoI got the email from HIBP but I've only ever owned one Seagate SATA HDD, never any of their NAS products, nothing cloud connected from them at all. This must be more than just Seagate.
- tegrq 3y agoSO apparently one of my emails is in the list and it seems to be some type of seagate service thing. The thing is, i do not remember at all of using any seagate services ever in my life time so how that can be?
- CBossy 3y agoI received an email from TotalAV telling me my details were included in a Naz.api data breach. I'm not sure I've ever used Seagate for anything.
- templeosenjoyer 3y agoThe leaked dataset Troy refers to wasn't the real Naz.API list, and the "illicit.services" website Troy says is defunct is actually online at https://search.0t.rocks/ https://search.0t.rocks/. You can use this to see if you're in the real Naz.API dataset (which is way scarier than the data shared on breachforums). Those who are particularly interested can abuse the wildcards for search to scrape passwords associated with some email/username and create their own Naz.API "mirror" (as far as I know, there are only a handful of people with access to this dataset), though the rate-limiting may prove to be an irritating obstacle. The site owner may find issue with this too, as it certainly wasn't intentional, but when I tried it a few months back it worked perfectly.
- aaquinoo88 3y ago[flagged]
- charcircuit 3y agoSearching it is timing out for me, but if this works it would be much more effective to know what actually leaked.
- templeosenjoyer 3y agoHa, it was working fine moments before I posted the comment, times out for me now too. Try revisiting later on, it definitely works great. From what I remember it was essentially created as a "fuck you" to Peter Kleissner, the creator of https://intelx.io/ https://intelx.io/, who charges exorbitant prices to search breaches.
- miyakoyako 3y ago0t creator here. Please do not scrape it! If you have a specific request for data (i.e. data from your business), look around for the riseup email on the announcements channel and contact from a DKIM validated company email address.
- jve 3y ago