Hacker, Hack Thyself

Re:Hacker, Hack Thyself by git_SHA on Friday June 02, 2017 @06:21AM (#14468845)

Would it be a bad security practice to keep a database of the SHA hashes of maybe the 10 000 most common passwords then alert users who try to use them? Obviously you would do the comparison before applying your actual bcrypt/PBKDF2 function with salt.

[ Parent | on HN ]

Re:Hacker, Hack Thyself by OliverM on Friday June 02, 2017 @06:24AM (#14468860)

Wouldn't it be easer to just test the submitted password against the 10,000 most common passwords directly, and refuse it then?

[ Parent | on HN ]

Re:Hacker, Hack Thyself by proaralyst on Friday June 02, 2017 @06:28AM (#14468875)

Which they already do; from the post:

> Users cannot use any password matching a blacklist of the 10,000 most commonly used passwords.

[ Parent | on HN ]

Re:Hacker, Hack Thyself by git_SHA on Friday June 02, 2017 @06:37AM (#14468917)

I read the post but somehow missed that. Sincere apologies.

[ Parent | on HN ]

Re:Hacker, Hack Thyself by infogulch on Friday June 02, 2017 @11:33AM (#14470633)

My question is, is 10k good enough? Wouldn't it be better to check against more? 50k?

[ Parent | on HN ]

Re:Hacker, Hack Thyself by gwern on Friday June 02, 2017 @12:27PM (#14471129)

Presumably more is always better, but there's a very long tail of passwords so the hit rate will drop off a cliff, and now you're storing 5x as much data for increasingly questionable benefit.

[ Parent | on HN ]

Re:Hacker, Hack Thyself by codinghorror on Friday June 02, 2017 @03:07PM (#14472532)

the problem is once you get to 10+ char passwords the common password list gets really tiny

[ Parent | on HN ]