Hacker News Reader

Comment by smaili | Hacker News Reader

Not to sound negative, but is this something we should really be exposing? It feels like the only ones who gain from this are hackers and password crackers, no?

View on HN

Like others have mentioned, the criminal hackers are already up on this stuff. It's more beneficial to the security community as a whole to expose these things so you know how to implement effective security policies. When your trying to convince management to implement something security related it's one thing to say "We think this is a threat" verses saying "hey watch this" and demonstrating the threat.

Audits. Education. Change.

It's not like bad guys don't already have wordlists, or that they are new in any way. Having good ones available, in the open, for everyone to use, provides a net benefit in the long run imo.

This is similar to my train of thought.

Year after year people still use the same passwords that were the most popular for the year before. I think we should make it as obvious as possible that it is worth your time to make secure passwords.

I think people know that they shouldn't use "password" as a password, but it just needs to be made very clear through safe means (such as publishing wordlists that don't have any associated user data) that it leaves you very vulnerable. Many people simply haven't stopped to wonder how secure their password is.

My goal with this project is to flip the status of the passwords on the list - and make them the LEAST likely to be used.

It's already exposed. That's the point. The adversary has this intel. It would be irresponsible not to study and publish it, thereby reducing their informational edge.

To quote a certain Alfred Charles Hobbs: "Rogues are very keen in their profession, and know already much more than we can teach them."

Also see: Security through Obscurity.

This doesn't have anything to do with 'security through obscurity'.

It might not be. When someone raises concerns around disclosing weak passwords or weakness in crypto, or security holes in general [0], I kind of like to think they are trying to think abt the problem in the wrong way. STO is a good framework, I think, to help people steer in the right direction, and hence the 'also see' label.

[0] Google's notorious Project Zero, for instance.

STO is a good framework

It's a fairly specific term so trotting it out for everything makes it pointless and obscures its actual meaning. Every time someone misunderstands something about information security (or someone thinks they do), someone else comes along and says 'Security through obscurity!' or 'Trusting trust!' or something about source code. It turns these things from terminology and concepts into magical-sounding incantations that really just mean 'I disagree/don't like this'.

This is analogous to the more familiar overuse of 'ad hominem' and 'straw man' and so on. It's not a good thing.

I get your gripe with the overuse. I now agree with the point you are trying to make. Thx.

Of course it has to do with security through obscurity... Passwords themselves are only security through obscurity.

No, they aren't. Not knowing something is not 'security through obscurity'. If it was, any encryption at all is 'security through obscurity' because, hey, you don't know the plaintext. That isn't what the term means at all.

Reply on news.ycombinator.com