News for hackers. Stuff that matters.

A comment on The 111M Record Pemiblanc Credential Stuffing List.

Re:The 111M Record Pemiblanc Credential Stuffing List by chrisbolt on Monday July 09, 2018 @09:28PM (#17494774)
These data breaches where the source isn't known can be frustrating. As someone who already uses unique passwords for everything, there's not much I can do (change 500+ passwords?). And I can understand Troy's argument[1] for not sharing the leaked password, so that doesn't leave many other options.

I guess I'll just start going through my saved passwords and use them to delete all of the old accounts I rarely use, maybe with a little help from the GDPR.

[1] https://www.troyhunt.com/here-are-all-the-reasons-i-dont-mak...

[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by Samon on Monday July 09, 2018 @09:36PM (#17494808)
My solution for this is to use a unique email address for each site/ service. That way if I see that [email protected] has appeared in a breach, I know both where the leak came from and which password to change. Also helps identify the source of any spam emails...
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by acover on Monday July 09, 2018 @09:44PM (#17494830)
You can also do this with Gmail by adding a . Or two randomly in your email.
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by djsumdog on Monday July 09, 2018 @09:51PM (#17494863)
Gmail and other MTAs support +something in the e-mail address user part too. If you forget your password, you do have to dig through your e-mail and figured out which one you used, but this method does let you track down when someone sells/shares your e-mail address or 3rd parties.
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by kbenson on Monday July 09, 2018 @10:05PM (#17494907)
You just have to remember the exact username/email you used in case you forget it. That can include the sitename itself, or some simple transform, but sometimes services change names... so make sure to keep records of exactly the email used for each service (or don't delete your email from them), forgetting that is worse than losing the password, since there's often no helpful recovery service they offer.
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by georgeappiah on Monday July 09, 2018 @10:29PM (#17494988)
The bigger problem is MANY MANY sites don't accept the (+) in an email address.
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by jstarfish on Tuesday July 10, 2018 @04:45AM (#17496330)
Yes. More and more sites are using common frameworks and/or validation libraries where a + is not considered to be an acceptable part of the recipient name.
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by icebraining on Tuesday July 10, 2018 @03:42AM (#17496087)
this method does let you track down when someone sells/shares your e-mail address or 3rd parties.

Unless they strip out the +something part.

[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by r1ch on Tuesday July 10, 2018 @06:19AM (#17496797)
Based on my experience this unfortunately does occur, as does removal of dots in the local part.
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by AndrewOMartin on Tuesday July 10, 2018 @06:14AM (#17496780)
spamgourmet.com is this idea as a free (and awesome) service.
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by kernelcode on Monday July 09, 2018 @09:39PM (#17494817)
Good idea
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by r1ch on Tuesday July 10, 2018 @06:18AM (#17496790)
I really don't think HIBP should even be publishing or notifying people about these. It's almost always existing breaches just merged together in a different way. If I went and grabbed the raw torrents and combined them in various ways I could make hundreds of different "credential stuffing" lists. Would HIBP list and notify people about all of them?
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by laken on Tuesday July 10, 2018 @07:28AM (#17497135)
This post doesn’t mention it, but on past credential stuffing lists that got loaded, Troy mentioned how many were new to the HIBP dataset. I’d assume that there were enough new emails on here to make it worth loading.
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by r1ch on Tuesday July 10, 2018 @12:41PM (#17499732)
94% of the email addresses were already in the database according to the Twitter account. 6% still represents many millions in this case, but perhaps it's unnecessary to notify the ones already known.
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by ikeboy on Tuesday July 10, 2018 @08:26AM (#17497389)
Post does mention it.
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by cgijoe on Monday July 09, 2018 @09:45PM (#17494833)
Once the huge password Torrent is updated with Pemiblanc (9 GB, last updated March 1, 2018), you can download it and scan it for all your passwords locally. Then you can determine which are pwned. You'll have to SHA-256 them all, but that shouldn't be too hard.
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by dmckeon on Tuesday July 10, 2018 @12:47AM (#17495564)
Check out a lower bandwidth approach: https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by ElCapitanMarkla on Tuesday July 10, 2018 @06:22AM (#17496809)
Thanks for pointing that link out, I hadn't come across that API before.
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by notananthem on Monday July 09, 2018 @10:05PM (#17494906)
I've never tried to follow up with which accounts/passwords have been used from haveibeenpwned, can you describe this further as I'll try this.

The "huge pw torrent" is something I can just search on torrent trackers? Once I have the list, its just a list of passwords, or includes the emails? Then they're sha-256 hashed and I need to ..unhash them?

[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by snailmailman on Monday July 09, 2018 @10:16PM (#17494943)
I think he is referring to Troy Hunts pwned password list.(which is about 9gb, afaik) Presumably it will be updated with these new plaintext passwords.

Once it’s updated, you can check all your passwords against the list. It’s a list of sha256-hashed passwords.(so he isn’t sharing tons of plaintext passwords, as sha256 can’t be reversed) You would sha256 your own passwords and check them all against the list.

Edit: to clarify, I think there are tools to help check against the offline list pretty easily. Or you could also query Troy hunts pwned password page (or its api)once it’s updated; instead of downloading 9gb. The k-anonymity model is pretty clever, and querying the site should be secure.

[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by DEADBEEFC0FFEE on Tuesday July 10, 2018 @02:17AM (#17495825)
I think Firefox is going to use Trent's list to check passwords use when browsing. That would actually make Firefox more functionally useful that other browsers.
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by DEADBEEFC0FFEE on Tuesday July 10, 2018 @02:19AM (#17495838)
https://thenextweb.com/security/2018/06/26/mozilla-bakes-hav...
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by qwerfasdcva on Monday July 09, 2018 @10:06PM (#17494914)
I also want to see this.
[ Parent | on HN ]
Re:The 111M Record Pemiblanc Credential Stuffing List by saagarjha on Monday July 09, 2018 @11:53PM (#17495301)
Well, you can see who leaked the password by checking for your password if it’s unique, right?
[ Parent | on HN ]