Re:Firefox to Warn When Saved Logins Are Found in Data Breaches
by bradknowles on Wednesday July 17, 2019 @07:39PM
(#20465176)
The thing is that all of the passwords in his database, are ones that the blackhats already know. As in, they not only have the hashes, but the full in-the-clear passwords. His sources for these lists are blackhats themselves, who happen to leak their copies of their password lists, one way or the other.
And all the major password cracking tools will typically try all the known bad passwords, before they try anything else. And they'll try all known likely variants, before making any potential brute-force attempts.
So, it doesn't matter if the password you want to use is on this list and you want to use it anyway, just because it has never been associated with your userid.
The simple fact that you're trying to use a known bad password that has ever been used before by anyone else, is enough to increase by many, many orders of magnitude the likelihood that someone will be able to crack your new favourite password.
Bad passwords are simply bad, regardless of who tries to use them. Some are worse than others, but they're all bad.
This aspect of HIBP helps you discover if any of your passwords have ever been cracked by anyone, and therefore now on the list of known bad passwords.
And all the major password cracking tools will typically try all the known bad passwords, before they try anything else. And they'll try all known likely variants, before making any potential brute-force attempts.
So, it doesn't matter if the password you want to use is on this list and you want to use it anyway, just because it has never been associated with your userid.
The simple fact that you're trying to use a known bad password that has ever been used before by anyone else, is enough to increase by many, many orders of magnitude the likelihood that someone will be able to crack your new favourite password.
Bad passwords are simply bad, regardless of who tries to use them. Some are worse than others, but they're all bad.
This aspect of HIBP helps you discover if any of your passwords have ever been cracked by anyone, and therefore now on the list of known bad passwords.