Hacker News Reader

Comment by ChrisSD | Hacker News Reader

I'm a little surprised he doesn't share actual password lists with at least some other security researchers. I get there are legal issues involved but I thought researchers had legal protections?

"Dark web" (lol) hackers are already going to be circulating the sources of this list and in any case could probably crack sha-1 reasonably quickly. So if you do a minimal amount of verifying the person who asks (e.g. ring their university) you can surely help the good guys with little risk of misuse?

View on HN

He recently shared Pwned Passwords which lets you check if your password is in the breached data.

1Password then did a POC integration into their service so you can test if your password shows up in HIBP data.

https://blog.agilebits.com/2018/02/22/finding-pwned-password...

Right but that's not so useful for security researches. Analysis of the actual passwords would be more useful.

His reasons:

https://www.troyhunt.com/no-i-cannot-share-data-breaches-wit...

https://www.troyhunt.com/here-are-all-the-reasons-i-dont-mak...

Indeed. I guess the best practical argument is sharing them securely is hard. Which is very true. However if it's not possible for two security researchers to exchange data then what hope is there for the rest of us?

I get he doesn't want to do that and that is his prerogative. However, it does feel like we're so scared of things falling into the wrong hands that we hobble our ability to defend against hacks in the first place.

I would imagine if there are any security researchers he trusts sharing the data with, they wouldn't need to email him out of the blue for it, nor need to discuss it with the rest of us.

But no, there is likely no hope, lol

https://haveibeenpwned.com/Passwords

They're SHA-1 hashes.

Two comments ago, you:

> in any case could probably crack sha-1 reasonably quickly.

So that shouldn't bother you then.

As I said, that shouldn't bother crackers. It does bother security researchers who have much less in the way of resources.

There's half a billion hashes. I don't see how anybody could crack them "reasonably quickly".

Most of them will be known already. It's mostly just a matter of comparing hashes or at worst converting plaintext SHA-1 (which is designed to be very fast).

And crackers will share unknown hashes to be cracked. So they can crowd source cracking far more effectively than the security community can.

That suggests the security community is less organized and has fewer resources than the crackers.

> That suggests the security community is less organized and has fewer resources than the crackers.

That suggestion likely reflects reality.

In addition, the list isn't connected with any specific accounts* - even if you broke the whole list (which it essentially is already, anyway) someone would have to match each one to some rando account. Not likely.

*unless you have the original breach, then we are back at zero: its already compromised.

Well exactly. It's of minimal (if any) use to crackers. But analysing cracked passwords could be of use for research.

500m salt-free hashes just mean your odds of getting a hit per hash go way, way, way up. Around one in 2.9e39 instead of 1.5e48.

Reply on news.ycombinator.com