Timeline for Does Microsoft's "Password Ban" list insecurely store user passwords?
Current License: CC BY-SA 3.0
6 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| May 29, 2016 at 17:13 | comment | added | David Cary | @oldmud0: Why would "other companies" buy such a password list when they can simply download a list from sites such as "Most common passwords list"; "Security Blanket"; "Unmasked: What 10 million passwords reveal"; "SecLists"; "Today I Am Releasing Ten Million Passwords"; etc.? | |
| May 26, 2016 at 23:30 | comment | added | D.W. | What you say in the second paragraph of your answer seems to line up with what Microsoft states in their blog post. However, the first paragraph is not correct. There are ways of keeping track of the most common passwords and blocking them, in a way that doesn't help break into accounts. See eecs.harvard.edu/~michaelm/postscripts/hotsec2010.pdf for a careful analysis. (Two of the authors on that paper work at Microsoft Research.) | |
| May 26, 2016 at 23:21 | comment | added | oldmud0 | @trysis And by services you mean websites that have already been hacked? Basically the algorithm learns from other websites' mistakes by making a giant list of "known" passwords from collected breach data, correct? I think such a database could easily be sold out to other companies. | |
| May 26, 2016 at 22:45 | comment | added | PwdRsch | @trysis Yes, that's correct. | |
| May 26, 2016 at 22:17 | comment | added | trysis | So, Microsoft is not banning passwords that are used too commonly on Accounts/Azure, but that are used too commonly on all services it can find data for? | |
| May 26, 2016 at 17:12 | history | answered | Xander | CC BY-SA 3.0 |