Today I Learned@lemmy.worldby𝜯𝐞𝐡 𝜝𝐚𝐦𝐬𝐤𝐢@lemmy.world
2 months

TIL: Besides offering a free compromised email check, haveibeenpwned.com also offers a free password compromise checking service (It's also fun to see what weird passwords have been used/leaked.)

haveibeenpwned.com English

Nerdy leaked passwords:

Treebeard - “This password has been seen 1,207 times before in data breaches!”

NedStark - 20 times

CerseiLannister - 30 times

youknownothingjonsnow - 61 times

PicardIsSexy - 0 times ([email protected] you’re safe. ;)

edit:

Gandalf1 - 53,478

Gandalfthewhite - 51

sexygandalf - 6

NSFW leaked passwords:

spoiler

bigdick - 178,712 (!?!)

bigpussy - 9,226

longpussy - 26

longdick - 10,762

wetpussy - 61,575

wetdick - 579

twat - 6,588

dickhead - 201,942

Blueballs69 - 520

Weird leaked passwords:

BillClinton - 378

DonaldTrump123 - 792

youwillneverguessmypassword - 390

redgreenblue - 2,040

123qweasdzxc - 1,010,515

poopstick - 6,845

((More to come later))

52
    Have I Been Pwned: Pwned Passwords
    haveibeenpwned.com
    Pwned Passwords is a huge corpus of previously breached passwords made freely available to help services block them from being used again.
    • Darkassassin07@lemmy.caEnglish
      2 months

      For those worried about inputting a password into a tool like this, they’ve actually done a great job keeping your pass secure.

      Passwords entered on this site do not get transmitted to the server. Instead, they are hashed, then only the first half of the hash is sent to the server. The server replies with a list of every password hash they’ve found in leaks that match the partial hash you sent them. Your computer then looks through the list and tells you if the password you entered (which was kept on your pc, not transmitted) exists in that list.

      From Haveibeenpwneds perspective; they sent you a big list of potential matches, but don’t know which one if any actually matches your password, because they were never given the full hash, let alone the raw password.

      There’s even an open-source script you can run that does this within a console instead of a browser. Or, you can download their whole password DB via their github tools, then check it entirely offline.

      • thejml@sh.itjust.worksEnglish
        2 months

        So, a malicious JavaScript library update then…

        The open-source local script might be better, I’ll have to check into that!

        • Darkassassin07@lemmy.caEnglish
          2 months

          You could say the same about every password entry field; but that’s why there are local/alternative options here.

      • Kazumara@discuss.tchncs.deEnglish
        2 months

        Alternatively just hash your password with SHA-1 or NTLM and put the first 5 character of the hash into this link: https://api.pwnedpasswords.com/range/{first-5-hash-chars} then check the results for the rest of the characters of your hash.

        Example flow:

        Your password: 1234
        Run echo -n "1234" | sha1sum | awk '{ print toupper($0) }' or some other method to locally generate the SHA-1 hash
        Resulting SHA-1 Hash: 7110EDA4D09E062AA5E4A390B0A572AC0D2C0220
        Split off 5: 7110E - DA4D09E062AA5E4A390B0A572AC0D2C0220
        Open Link https://api.pwnedpasswords.com/range/7110E
        Search for DA4D09E062AA5E4A390B0A572AC0D2C0220
        Find: DA4D09E062AA5E4A390B0A572AC0D2C0220:30272674
        So this password appears a bit over 30 million times in the breach data he has.

        All Troy gets from you, if you do this, is the first 5 characters of your hash, which is pretty useless.

    • THE_GR8_MIKE@lemmy.worldEnglish
      2 months

      I don’t know if I want to be putting my passwords in to something like this lol

      • FiskFisk33@startrek.websiteEnglish
        2 months

        very sane reaction.

        I have to say though, haveibeenpwned is very well regarded in the industry, and is run by a well known security expert. A leak from there would be quite the blow to his reputation.

        https://en.wikipedia.org/wiki/Have_I_Been_Pwned

        That said, while I happily give them my email-addresses, I have never given them my password.

        • nogooduser@lemmy.worldEnglish
          2 months

          A leak from there would be quite the blow to his reputation.

          I’m not so sure that it would be a huge blow. He’s only human and everyone is susceptible to the odd mistake.

          He did get phished last year and blogged about it after it happened which is the transparent approach that security experts say is the correct response. I’m pleased that he followed the advice that he gives to be honest and don’t think any less of him for suffering a breach.

          https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/

          • FiskFisk33@startrek.websiteEnglish
            2 months

            Fair, I misstated that. A deliberate leak from there would be quite the blow to his reputation.

        • thejml@sh.itjust.worksEnglish
          2 months

          All it takes is a malicious actor to MITM or a compromised codebase or any other malicious things to slip in something and its also pwned.

          I’ve seen too many widely recognized and supposedly secure things fail, to trust this with my passwords.

          • FiskFisk33@startrek.websiteEnglish
            2 months

            I’d argue though, if you use a single password for everything, its probably more secure to add it here to at least get an indication when it’s breached. Your surface in that case is already so large that the difference is negligible compared to the gained warning.

            That said, don’t reuse passwords!

          • Tetsuo@jlai.luEnglish
            2 months

            I suppose they use JavaScript to hash your password locally so all haveibeenpwned has is your hash.

            It’s certainly not full proof but it means a simple MITM attack wouldn’t be that bad.

            The risk would be that the JavaScript in question would be compromised for the whole service. Also if the machine of the user is already compromised well I would argue that password is already useless anyway. If someone has a keylogger on your system, ihavebeenpwnd would be the least of your concern.

            So it’s never foolproof but some risk can be mitigated.

            Hashes are a powerful tool enabling easy check of leaks without exposing directly any user password.

            Edit: Hmm there is much better explanations than mine on hashes on here, probably disregard the above comment.

            • NachBarcelona@piefed.socialEnglish
              2 months

              Because using a reputable k-anonymity service is as risky as throwing apple peels in the trash. Or just looking at an apple.

              • FiskFisk33@startrek.websiteEnglish
                2 months

                I’d argue it’s generally a very sane reaction to instinctively say no when some service you don’t know about wants your password.

                The commentor you replied to obviously didn’t know about the pedigree of haveibeenpwned beforehand

            • THE_GR8_MIKE@lemmy.worldEnglish
              2 months

              Same person said that to me too and refuses to elaborate. Really strengthens their argument.

      • AnyOldName3@lemmy.worldEnglish
        2 months

        It makes a cryptographically-secure hash of the password you enter, then truncates that before sending it to the server so the only information they get would be in common with a huge number of other passwords. They then send back the leaked passwords with the same truncated hash, and your computer checks to see if what you’ve entered matches anything on the list. It’s not practical to send the whole list for every query as there’s just too much data, but if you don’t trust their site, you can just download the whole list and check against it yourself.

    • hansolo@lemmy.todayEnglish
      2 months

      For anyone reasonably concerned about the obvious boneheaded move of checking your email and then entering your password, here’s some options:

      • Don’t check them at the same time or on the same device. Use wifi and a laptop to check your email. 20 minutes later on your phone and 5G, check your password. Two different IP addresses and browser fingerprints.

      • Use Tor

      • Change VPN locations and browsers on the same device.

      • Don’t just check your password and close the page. Check 10 made up BS passwords and throw yours in the middle.

      This is all on top of the fact that HaveIBeenPwned has been a beacon of sanity for more then a decade. Troy Hunt remains huge in the cybersecurity research space, and diligently combs over data leaks. This site was one of Gizmodo’s 100 sites that shaped the internet in 2018, and remains the most accessible database of leaked credentials there is, without actually giving away the credentials.

      Now go check yourself before someone else wrecks yourself.

      • 𝜯𝐞𝐡 𝜝𝐚𝐦𝐬𝐤𝐢@lemmy.worldEnglish
        2 months

        I felt about the same way when I tested for that. hahaha.

        Try some keyboard walking combos. You’ll start see why so many people in I.T. are bald at early ages, starting to have grey hair before they hit 50, etc. lol

        Examples: qwer ., asdf , zxcv , qweasdzxc

    • northernlights@lemmy.todayEnglish
      2 months

      TIL that besides offering a password compromise checking service, they also offer a compromised email checking service!

    • LordKitsuna@lemmy.worldEnglish
      2 months

      This functionality is built-in to bitwarden, they can safely check your entire vault for known breaches

    • Reygle@lemmy.worldEnglish
      2 months

      They’re missing a real opportunity here- when someone enters the “password” 12345, which 31,033,620 times by the way, their page should immediately display this