Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


BDFL - Memuneh
60605 posts

Uber Geek
+1 received by user: 11541

Administrator
Trusted
Geekzone
Lifetime subscriber

Topic # 237519 5-Jun-2018 21:54
7 people support this post
Send private message quote this post

I am thinking of adding a small piece of logic that will test your password at login, using the http://haveibeenpwned.com/ API to determine if the password you use to login on Geekzone has been compromised in another site - reusing passwords is quite normal and people don't think much about it.

 

My question is - how do think a message like "The password you use on Geekzone has been previously used by yourself or someone else on another site. This password has been leaked as per http://haveibeenpwned.com/. We suggest you change your password on Geekzone and other sites. Make sure to create unique passwords for each service you use."

 

Do you think this is clear enough so that most people understand a compromised password wasn't leaked by Geekzone, but some other service? Suggestions?

 

To be clear, testing via their API never sends a password but only a hash of it. We'd do this check at login time because that's the time our scripts have your password - we salt and hash the password before it's stored in our database so we wouldn't know it.





View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2
303 posts

Ultimate Geek
+1 received by user: 56

Subscriber

  Reply # 2030371 5-Jun-2018 21:57
Send private message quote this post

Good idea, suggest you do this





gml


2465 posts

Uber Geek
+1 received by user: 663


  Reply # 2030373 5-Jun-2018 22:05
Send private message quote this post

So the test page says I’ve been compromised... is this a legit test of my password, or a test of the ‘compromised’ message 🤔

mdf

1802 posts

Uber Geek
+1 received by user: 516

Trusted
Subscriber

  Reply # 2030378 5-Jun-2018 22:09
3 people support this post
Send private message quote this post

+1 great idea. You're speaking to a relatively tech savvy audience (I hope?). The short message is good (perhaps with some bolding or caps "The password you use on Geekzone has been previously used by you or someone else on another site that has been compromised"), but I'd put a link to a longer explanation as to how we test (i.e. we didn't send your password in the clear to anyone) and how to pick a good password (cough, link to a password manager).




BDFL - Memuneh
60605 posts

Uber Geek
+1 received by user: 11541

Administrator
Trusted
Geekzone
Lifetime subscriber

  Reply # 2030380 5-Jun-2018 22:12
Send private message quote this post

PhantomNVD: So the test page says I’ve been compromised... is this a legit test of my password, or a test of the ‘compromised’ message 🤔


Did you put your own password there? If so, then yes. That page is not testing your actual password as we don't know it.






BDFL - Memuneh
60605 posts

Uber Geek
+1 received by user: 11541

Administrator
Trusted
Geekzone
Lifetime subscriber

  Reply # 2030384 5-Jun-2018 22:20
2 people support this post
Send private message quote this post

@PhantomNVD: So the test page says I’ve been compromised... is this a legit test of my password, or a test of the ‘compromised’ message 🤔

 

Let me clarify... The test page linked here is just a demo and uses the password you pass as a parameter in the URL. We don't know your password because it's hashed in our database. The idea is to put this same code in the login script and automatically let you know of something "strange" with your password. The demo is just for me to know the code works (and for you to play with)

 

How it works?

 

https://haveibeenpwned.com/ has a list of emails that leaked over the years from different services. Visit the site and enter your email address. It will tell you where it leaked and I strongly suggest you change your password on any of those services listed.

 

They also offer a password lookup service. You can enter a password and it will tell you if it's been compromised.

 

Now, it may be YOUR password. Or may be other people used the same password as you. For example "password", "god" are very common passwords so of course they will show as compromised. "IhaveaRedHorsethatannoy$inWellington" is not a common password - it's not compromised but that's not to say someone haven't used it.

 

A lot of people reuse their passwords in different services. This is bad because if one service leaks the password some Bad Guy (TM) can just use your email/password and go around trying to login - let's say they find your email and password on a Dial-a-Pizza service and then try on your Bank of My Country. And you used the same password in both. You're done.

 

So this service won't say YOUR password leaked. It will tell you that YOUR password or someone else's password that is exactly the same as yours, leaked. You then should go to the https://haveibeenpwned.com/ and check if your email is part of a leak.

 

In either case if your password is shown as compromised you should change it for something safer and unique.

 

Makes sense?







BDFL - Memuneh
60605 posts

Uber Geek
+1 received by user: 11541

Administrator
Trusted
Geekzone
Lifetime subscriber

3068 posts

Uber Geek
+1 received by user: 1715

Trusted
Lifetime subscriber

  Reply # 2030389 5-Jun-2018 22:34
Send private message quote this post

This is great tested mine and all good

 

Password ok 200

 

John





Ex JohnR VodafoneNZ 17 years 4 days

Go Hawks!
862 posts

Ultimate Geek
+1 received by user: 46

Trusted
Subscriber

  Reply # 2030404 5-Jun-2018 23:17
One person supports this post
Send private message quote this post

freitasm:

 

Funny thing is someone used "Trump" as a password...

 

 

I believe you've just leaked the President of the US of A's password ... oops!

 

 


644 posts

Ultimate Geek
+1 received by user: 265


  Reply # 2030448 6-Jun-2018 07:26
One person supports this post
Send private message quote this post

freitasm:

 

or someone else's password that is exactly the same as yours, leaked.

 

 

I'm more concerned about my email address and password pair being compromised, can you query for a match on both?

 

 










BDFL - Memuneh
60605 posts

Uber Geek
+1 received by user: 11541

Administrator
Trusted
Geekzone
Lifetime subscriber

1970 posts

Uber Geek
+1 received by user: 758

Subscriber

  Reply # 2030488 6-Jun-2018 08:55
Send private message quote this post

The "haveibeenpwned" website says that I have been!

 

But when I look it gives a set of websites that have been exploited and the dates... and my passwords are all much newer than that and are machine generated gobbledygook - does that mean I'm ok?

 

 

 

 


1970 posts

Uber Geek
+1 received by user: 758

Subscriber

  Reply # 2030491 6-Jun-2018 08:59
Send private message quote this post

freitasm:

 

Funny thing is someone used "Trump" as a password...

 

 

It says "compromised" if you put any actual words or names in there such as "alphabet" or "mauricio" ... does dictionary existence automatically give a "compromised"?

 

 


1526 posts

Uber Geek
+1 received by user: 143

Trusted

  Reply # 2030495 6-Jun-2018 09:12
Send private message quote this post

Suggest you kill all sessions (we've had it happen a few times in recent weeks,what is once more) once this is implemented to clean the database.

 

Better yet do not let people use these passwords at all, they have to keep trying until its not in the database.

 

Maybe also include a link to password safes (keepass etc) to help people do better





CPU: Intel 3770k| RAM: F3-2400C10D-16GTX G.Skill Trident X |MB:  Gigabyte Z77X-UD5H-WB | GFX: GV-N660OC-2GD gv-n660oc-2gd GeForce GTX 660 | Monitor: Qnix 27" 2560x1440

 

 


4851 posts

Uber Geek
+1 received by user: 1508


  Reply # 2030501 6-Jun-2018 09:24
One person supports this post
Send private message quote this post

mentalinc: [snip]

 

Better yet do not let people use these passwords at all, they have to keep trying until its not in the database.

 

 

If I understand correctly though, this is a database of basically any password that any person has used, so people are being asked to have a password that is globally unique to any account from any person - that's a pretty tall order.

 

 


1970 posts

Uber Geek
+1 received by user: 758

Subscriber

  Reply # 2030510 6-Jun-2018 09:37
2 people support this post
Send private message quote this post

RunningMan:

 

mentalinc: [snip]

 

Better yet do not let people use these passwords at all, they have to keep trying until its not in the database.

 

 

If I understand correctly though, this is a database of basically any password that any person has used, so people are being asked to have a password that is globally unique to any account from any person - that's a pretty tall order.

 

 

Easy to do if you use a machine generated random password. However as these are basically impossible to remember it means you'll need to either write them down (insecure) or use a password manager such as LastPass, which is potentially a catastrophic vulnerability if it is broken into.

 

I use LastPass... I am on so many systems it's impossible not to without sharing passwords between them.

 

 

 

 


 1 | 2
View this topic in a long page with up to 500 replies per page Create new topic

Twitter »

Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

N4L helping TAKA Trust bridge the digital divide for Lower Hutt students
Posted 18-Jun-2018 13:08


Winners Announced for 2018 CIO Awards
Posted 18-Jun-2018 13:03


Logitech Rally sets new standard for USB-connected video conference cameras
Posted 18-Jun-2018 09:27


Russell Stanners steps down as Vodafone NZ CEO
Posted 12-Jun-2018 09:13


Intergen recognised as 2018 Microsoft Country Partner of the Year for New Zealand
Posted 12-Jun-2018 08:00


Finalists Announced For Microsoft NZ Partner Awards
Posted 6-Jun-2018 15:12


Vocus Group and Vodafone announce joint venture to accelerate fibre innovation
Posted 5-Jun-2018 10:52


Kogan.com to launch Kogan Mobile in New Zealand
Posted 4-Jun-2018 14:34


Enable doubles fibre broadband speeds for its most popular wholesale service in Christchurch
Posted 2-Jun-2018 20:07


All or Nothing: New Zealand All Blacks arrives on Amazon Prime Video
Posted 2-Jun-2018 16:21


Innovation Grant, High Tech Awards and new USA office for Kiwi tech company SwipedOn
Posted 1-Jun-2018 20:54


Commerce Commission warns Apple for misleading consumers about their rights
Posted 30-May-2018 13:15


IBM leads Call for Code to use cloud, data, AI, blockchain for natural disaster relief
Posted 25-May-2018 14:12


New FUJIFILM X-T100 aims to do better job than smartphones
Posted 24-May-2018 20:17


Stuff takes 100% ownership of Stuff Fibre
Posted 24-May-2018 19:41



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.