Re:Firefox to Warn When Saved Logins Are Found in Data Breaches
by prophesi on Wednesday July 17, 2019 @08:19PM
(#20465417)
Sure, the source they're referencing, with a plaintext torrent, is here: https://hashes.org/leaks.php?id=515 which was last updated yesterday.
However, this shouldn't be alarming.
1) Attackers already have the plaintext password of these hashes. That's why they're in HIBP's repository in the first place.
2) You should already assume most sites/apps don't have proper security hygiene. Password re-use is what will get you. If you wish to warn your users if they're reusing a password, then HIBP's API should already do well for that.
3) You have truly astronomical odds of generating the same password as one in a leaked database should yours contain enough bits of entropy. Remember that GPU's are making millions of guesses per second in the first place when cracking passwords, and significantly slower if the hashing algorithm protects against GPU attacks.
However, this shouldn't be alarming.
1) Attackers already have the plaintext password of these hashes. That's why they're in HIBP's repository in the first place.
2) You should already assume most sites/apps don't have proper security hygiene. Password re-use is what will get you. If you wish to warn your users if they're reusing a password, then HIBP's API should already do well for that.
3) You have truly astronomical odds of generating the same password as one in a leaked database should yours contain enough bits of entropy. Remember that GPU's are making millions of guesses per second in the first place when cracking passwords, and significantly slower if the hashing algorithm protects against GPU attacks.