Project Svalbard: The Future of Have I Been Pwned

Re:Project Svalbard: The Future of Have I Been Pwned by w8rbt on Tuesday June 11, 2019 @06:53AM (#20154322)

I hope that the SHA1 hashes remain freely available for download. I use them to build a bloom filter for password vetting.

We should all do away with password complexity rules (except minimum length) and simply test a large, comprehensive exposed password bloom filter for membership. It's very fast (constant time) and efficient and if the test returns no, then it's safe for a user to select that password.

Here's the code: https://github.com/w8rbt/bp

Also note that this approach satisfies the updated (June 2017) NIST 800-63-3B password vetting guidelines.

[ Parent | on HN ]

Re:Project Svalbard: The Future of Have I Been Pwned by ttt111222333 on Tuesday June 11, 2019 @08:10AM (#20154689)

Cool! I did something similar. First I used a bloom filter then a golomb set. https://github.com/terencechow/pwnedpasswords

[ Parent | on HN ]

Re:Project Svalbard: The Future of Have I Been Pwned by w8rbt on Tuesday June 11, 2019 @08:21AM (#20154735)

Very nice. I've never used a Golomb Set (looks interesting). I bet we'll see more organizations doing this and maybe in five to ten years, it'll be the norm.

[ Parent | on HN ]

Re:Project Svalbard: The Future of Have I Been Pwned by fjsolwmv on Tuesday June 11, 2019 @01:48PM (#20157726)

That doesn't work, because of hunter2 is in the PW database but hunter3 isn't, your system will think hunter3 is secure even though it's not.

[ Parent | on HN ]

Re:Project Svalbard: The Future of Have I Been Pwned by noisy_boy on Tuesday June 11, 2019 @02:22PM (#20158093)

I think it should be two step - checking against the list and if that passes, complexity check. Covers complex passwords that are known to have been in use/leaked and non-complex ones too.

[ Parent | on HN ]