Timeline for Why check your email in haveibeenpwned rather than regularly changing your password regardless of any leaks?
Current License: CC BY-SA 4.0
16 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 22, 2019 at 15:13 | comment | added | Frank Hopkins | @TylerH That might be, but I never stumbled over it. Compared to what I've seen, MS is the gold standard of usable. | |
| Jan 22, 2019 at 15:12 | comment | added | TylerH | @Darkwing I think MS is quite guilty of this -- there's no way to display password complexity requirements AFAIK in Windows when changing your AD/local password. | |
| Jan 22, 2019 at 15:02 | comment | added | Frank Hopkins | @TylerH You don't need to tell me that^^ I'd have loved a clear UI with reasonable restrictions and no or a reasonable password change policy, the reality I've seen is different. | |
| Jan 22, 2019 at 14:59 | comment | added | TylerH | @Darkwing it shouldn't be a secret what pattern of password works if you're an employee. You should know exactly what kinds of requirements are in place so you don't try to enter an unacceptable password choice 10 times before finally landing on one that works. | |
| Jan 21, 2019 at 16:17 | comment | added | anaximander | @RedGrittyBrick While you're correct that HIBP can't necessarily tell you what was breached; it depends on the nature of the breach. If a file surfaces containing a great many email/password combinations with no contextual info, like the Collection #1 or AntiPublic lists, then sure, there's no real way to know where that came from. However, if it's a disclosed breach, or the data is recovered with sufficient context, then that's a different story. For example, HIBP can tell you if you were in the LinkedIn breach, or the Dropbox breach, because of how those ones came to light. | |
| Jan 21, 2019 at 13:02 | comment | added | Frank Hopkins | @LightnessRacesinOrbit When you switch jobs or work as a contractor you also tend to encounter big international corporations that have password policies so ridiculously strict that you learn the patterns that will guarantee acceptance by the system from colleagues / other contractors working longer with that big corp. Suffice to say that those patterns are easy to remember and shared not only by contractors but internal workers as well and so prevalent I'd say 50% of the company using them is a low estimate. | |
| Jan 21, 2019 at 12:12 | comment | added | James_pic | @RedGrittyBrick HIBP do now offer a service to check if passwords have been pwned, by hash. This is their new pwnedpasswords service. | |
| Jan 20, 2019 at 20:31 | comment | added | Rory Alsop♦ | @lightness - password strength audits. Not what Ben suggested. Simply put, brute force of SAM file, then reporting on how many were a dictionary word, or "password" or football teams or holiday destinations etc. Not associated with user accounts, despite some organisations asking us for them - just a very useful way to give statistics | |
| Jan 20, 2019 at 20:18 | comment | added | Ben Voigt | @LightnessRacesinOrbit: That was my first reaction to the idea. But several years ago it was pointed out to me that these tests are done during the password change process -- the new password needs to be in the clear during that process, but it never needs to be stored that way. | |
| Jan 20, 2019 at 20:14 | comment | added | Lightness Races in Orbit | @BenVoigt How could such a tool know about things like "incrementing final digit" or "change month or season name" unless passwords are stored in the clear? | |
| Jan 20, 2019 at 19:33 | comment | added | Ben Voigt | @LightnessRacesinOrbit: An automated password strength test might report statistics on which particular rules are being violated, without disclosing passwords, or even which accounts were involved. | |
| Jan 20, 2019 at 17:53 | comment | added | Lightness Races in Orbit | @RoryAlsop How do you know what passwords "a few thousand employees at various organisations" are using? Nobody, and I mean nobody, should have access to, or be able to have access to, this information. What am I missing? | |
| Jan 20, 2019 at 17:47 | comment | added | Rory Alsop♦ | In running password audits over a few years with a few thousand employees at various organisations, I can tell you the repeated patterns are incredibly common. Most are incrementing final digit. Some are change month or season name. | |
| Jan 20, 2019 at 14:05 | comment | added | gnasher729 | It's not just repeated pattern. If I switch from "supersecurepassword" to "supersecurepassword1", ...2, ...3 that's pointless but not worse than not changing. The problem is that people change from "supersecurepassword" to "supersecure1" and 24 months later to "super24" because they just can't be bothered, so secure passwords are replaced with less secure ones. | |
| Jan 20, 2019 at 11:05 | comment | added | RedGrittyBrick | To expand on this: For HIBP to identify which password or which service is compromised I believe you have to use a different userID on each service. It isn't enough to have the same UserID but different passwords on each service. For example the Onliner Spambot 711 million address breach data, you cannot find the service or password for a pwnd email-address used as a login ID on multiple sites (with differing pws for each). HIBP by policy do not disclose PWs and do not even provide a hash that you could check. | |
| Jan 19, 2019 at 22:02 | history | answered | Rory Alsop♦ | CC BY-SA 4.0 |