Firefox to Warn When Saved Logins Are Found in Data Breaches

Re:Firefox to Warn When Saved Logins Are Found in Data Breaches by jammygit on Wednesday July 17, 2019 @05:08PM (#20464039)

Apparently most of the SHA1 hashes of haveibeenpwned passwords were cracked about a year ago:

https://blog.cynosureprime.com/2017/08/320-million-hashes-ex...

I wonder if segments of the list are around to create a password-blacklist

edit: previous discussion https://news.ycombinator.com/item?id=16799826

[ Parent | on HN ]

Re:Firefox to Warn When Saved Logins Are Found in Data Breaches by prophesi on Wednesday July 17, 2019 @08:19PM (#20465417)

Sure, the source they're referencing, with a plaintext torrent, is here: https://hashes.org/leaks.php?id=515 which was last updated yesterday.

However, this shouldn't be alarming.

1) Attackers already have the plaintext password of these hashes. That's why they're in HIBP's repository in the first place.

2) You should already assume most sites/apps don't have proper security hygiene. Password re-use is what will get you. If you wish to warn your users if they're reusing a password, then HIBP's API should already do well for that.

3) You have truly astronomical odds of generating the same password as one in a leaked database should yours contain enough bits of entropy. Remember that GPU's are making millions of guesses per second in the first place when cracking passwords, and significantly slower if the hashing algorithm protects against GPU attacks.

[ Parent | on HN ]