TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

300M Freely Downloadable Pwned Passwords

318 点作者 urahara将近 8 年前

23 条评论

oelmekki将近 8 年前
I really would love we be done with passwords altogether. We&#x27;re asking non power users to make their password unique, and then make it complicated, and then remember all of them in their head, not on a post-it. Nobody can do that, not even us who are telling them to do that. And then, we explain to them they&#x27;re dumb if they didn&#x27;t do that.<p>Currently, my way to generate a new password is this : `pwgen | md5sum`. And then, I use &quot;lost password&quot; everywhere (but for my mailbox, obviously), that is, the rare times my browser is not already prefilling the login form.<p>This makes me wonder why we don&#x27;t just go with that : generate a random password for the user in registration form, allow the browser to save it. On the login form, check if fields are prefilled. If not, only display an email field and send an auth link as mail. User clicking it (once, and fast enough) is logged in.<p>You still have to remember your mailbox password, but that&#x27;s the only one, quite akin the root password of a server.
评论 #14922687 未加载
评论 #14927274 未加载
评论 #14925426 未加载
评论 #14922622 未加载
评论 #14923890 未加载
评论 #14934351 未加载
评论 #14923600 未加载
评论 #14922693 未加载
评论 #14925625 未加载
devy将近 8 年前
Can Troy or someone contact Google (bq-public-data@google.com) and push this to the GCP&#x27;s BigQuery public dataset[1] for hosting and easier look up your password via SQL in BigQuery rather than some 3rd party site?<p>[1] <a href="https:&#x2F;&#x2F;cloud.google.com&#x2F;bigquery&#x2F;public-data&#x2F;" rel="nofollow">https:&#x2F;&#x2F;cloud.google.com&#x2F;bigquery&#x2F;public-data&#x2F;</a>
评论 #14921652 未加载
oliwarner将近 8 年前
An interesting element to this is how resistant some people are too using torrents for legitimate purposes, even as a backup mirror.<p>It&#x27;s something we&#x27;ve come to embrace in the Linux world. <i>Much</i> faster than a single server and saves bandwidth at individual sites. Surprised this pragmatism hasn&#x27;t reached the rest of you yet.
评论 #14920556 未加载
peteretep将近 8 年前
I wonder how we force change with individual companies? Today I had to sign up for a UPS account. The password length was set to max 27 characters, and the form had disabled paste in the password field.<p>Who do we lobby to get them to fail their next PCI-DSS compliance test?
评论 #14920402 未加载
评论 #14918399 未加载
评论 #14919992 未加载
评论 #14921618 未加载
评论 #14919347 未加载
评论 #14920678 未加载
评论 #14918379 未加载
jaclaz将近 8 年前
I don&#x27;t get it.<p>&gt;Do not send any password you actively us to a third-party service - even this one.<p>So I can only test password that I am not using (and by extension that I am not going to use in the future).<p>&gt;oh no - pwned!<p>&gt;This password has previously appeared in a data breach and should never be used. If you&#x27;ve ever used it anywhere before, change it immediately!<p>If I cannot (shouldn&#x27;t) submit any password I am actively using, what does it matter if I used it before? Now I already changed it.
评论 #14922580 未加载
captn3m0将近 8 年前
Going to generate a bloom-filter from this dataset tonight.<p>Troy mentions some arguments against torrents, but it is better to have a authoritative torrent than none, imo.
评论 #14919330 未加载
评论 #14918493 未加载
评论 #14921760 未加载
评论 #14920233 未加载
评论 #14920863 未加载
colinbartlett将近 8 年前
I do agree with Troy that this could be useful to send to relatives and family:<p>&gt; I&#x27;m envisaging more tech-savvy people using this service to demonstrate a point to friends, relatives and co-workers: &quot;you see, this password has been breached before, don&#x27;t use it!&quot;<p>But I can&#x27;t be the only one whose family would be baffled by the term &quot;pwned&quot;. I wish it said something like &quot;Your password has been hacked!&quot; which we all know not to be technically correct but would resonate a lot more.
评论 #14920645 未加载
excitom将近 8 年前
&gt;If a password is not found in the Pwned Passwords set, it&#x27;ll result in a response like this:<p>Wait, so I test my password to see if it&#x27;s &quot;good&quot; and now you have a copy of a password I will be using. Am I just being paranoid?
评论 #14922420 未加载
评论 #14922423 未加载
评论 #14922399 未加载
Deimorz将近 8 年前
One really unfortunate aspect of the passwords being hashed is that there&#x27;s no info available about their lengths. Knowing the lengths could allow you to reduce the size considerably when you enforce a minimum password length.<p>For example, if I have a site that requires passwords to be at least 10 chars long, I don&#x27;t need any of the data for breached passwords that are shorter than 10 characters. People can&#x27;t possibly use them anyway, so that&#x27;s probably a huge chunk of the data that&#x27;s completely useless to be storing and checking.
评论 #14933480 未加载
aj7将近 8 年前
If I test my passwords, aren&#x27;t they also now pwned?
评论 #14921339 未加载
评论 #14921287 未加载
评论 #14921418 未加载
r_singh将近 8 年前
Is it safe to test my password on this website? (because I just did)
评论 #14918427 未加载
评论 #14918498 未加载
评论 #14918434 未加载
评论 #14919281 未加载
评论 #14919158 未加载
nicpottier将近 8 年前
I used one password for a decade or so in the 90s and early naughts and though I&#x27;ve since moved on to use LastPass and two factor for everything this is the first time that password appears in one of these databases.<p>Guessing it was in MySpace..<p>Ironically I used another password for sites I trusted less and that one isn&#x27;t in there.
mbid将近 8 年前
As others have pointed out, the use case for pasting plain text passwords is not quite clear. Maybe it would be a good idea to allow searching for hashes only, or at least hash the password in js on the client.<p>Also, I&#x27;m genuinely curious as to why SHA-1 is used and not SHA-256. Surely the one-time additional cost of using SHA-256 would&#x27;ve been negligible for Troy? If at some point somebody manages to do preimage attacks on SHA-1, I have to assume my password is broken if I&#x27;ve submitted its hash to his API. Although I guess you&#x27;d have to actually be able to enumerate preimages, preferably from small to big. Still, I don&#x27;t understand why Troy doesn&#x27;t account for the possibility by using a hash function widely considered to be stronger.
评论 #14924716 未加载
r0f1将近 8 年前
What would be the best data structure for using this in, say, a Python script? I imagine just putting it into a dictionary (hash map etc.) won&#x27;t work because of the size.
评论 #14918771 未加载
评论 #14918780 未加载
pjf将近 8 年前
Someone should apply deep learning to this and check how it compares with brute-forcing passwords. E.g. <a href="https:&#x2F;&#x2F;github.com&#x2F;thoppe&#x2F;5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;thoppe&#x2F;5baa61e4c9b93f3f0682250b6cf8331b7e...</a>
评论 #14924346 未加载
评论 #14921564 未加载
_wldu将近 8 年前
Many of these passwords are one or two characters in length. I think the 300 million number is inflated for publicity. Who allows a password that only has one character?<p>Go here and type the character &#x27;a&#x27;:<p><a href="https:&#x2F;&#x2F;haveibeenpwned.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;haveibeenpwned.com&#x2F;</a>
评论 #14924810 未加载
Freaky将近 8 年前
Quick script to binary-search for passwords locally: <a href="https:&#x2F;&#x2F;gist.github.com&#x2F;Freaky&#x2F;4cb7ce8c107c3da2e4a8210356e8da25" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;Freaky&#x2F;4cb7ce8c107c3da2e4a8210356e8d...</a>
coldsmoke将近 8 年前
Interesting - &quot;correct horse battery staple&quot;[0] is flagged as not being in the data set. I was sure someone should have used that by now.<p>[0] <a href="https:&#x2F;&#x2F;xkcd.com&#x2F;936&#x2F;" rel="nofollow">https:&#x2F;&#x2F;xkcd.com&#x2F;936&#x2F;</a>
评论 #14918625 未加载
danso将近 8 年前
I&#x27;m enjoying typing in things that I&#x27;ve never used as passwords (my own name, for example) to see if anyone else at some point thought these things would make for good passwords.
nischalsamji将近 8 年前
HIBP provides a REST API to check if a password has been found in a breach, Is there a disadvantage of using it in applications and restricting users not to use the breached password?
评论 #14920184 未加载
oxplot将近 8 年前
Woha, wait a second:<p>&gt; Each of the 306 million passwords is being provided as a SHA1 hash.<p>That&#x27;s it? Without any salting? This would make it trivial to recover the plain text using rainbow tables.
评论 #14925077 未加载
j_s将近 8 年前
Would it make sense to host the file on a cheap OVH&#x2F;Scaleway VPS with unlimited bandwidth? I guess CloudFlare doing it for free beats that though!
评论 #14919206 未加载
misticdeveloper将近 8 年前
I&#x27;m confused. If a website salted their hashes, wouldn&#x27;t it not matter if he password alone was &quot;pwned&quot;?
评论 #14925308 未加载