Remove my password from lists so hackers won't be able to hack me (2017) | Hacker News Reader

Remove my password from lists so hackers won't be able to hack me (2017)

github.com

160 pointssrathi55 comments

There was this spoofed page that looked just like plain, unordered text file of passwords, that intercepted ctrl-f, displayed searchbox look-alike based on your user-agent and generated entries to match the password you are typing, so it looked as if your password was there. Anyone happens to remember the URL?

Damn this is pure evil.

I don't see my password on the list, but I want to make sure it stays that way. I wonder if they'd be willing to add a list of passwords never to be included on any list so as to keep their users safe.

https://en.wikipedia.org/wiki/Russell%27s_paradox

Reminds me of bash.org's hunter2 snip. http://bash.org/?244321=

If you do a search in the repo you'll find that hunter2 remains a commonly used password.

Oh wow! I'll have to start grepping for hunter2 everywhere....

I regularly use hunter2 as the example or test value for passwords/keys. I wonder how many other people do this, and how many times it's accidentally leaked into production...

It is a pretty good password. Just "hunter" is no good because it has no digits, so of course you'd add a "1"... but wait! It's actually a 2! That's the pro security twist the hackers won't expect.

It will take twice as long to crack, because hackers will have to try all letter combinations ending in 1 first.

I've got the devs using "password123" as the default in code because that value gets over-written.

Freaks me out every time I see it and I'm trying to get them to use "overwritten_on_deploy" or something similar.

Previous discussion: https://news.ycombinator.com/item?id=16009459

Also see: http://blog.assafnativ.com/2018/02/dolphins.html

Yes, the title should specify 2018

The page is from 2017.

The pull request was made at the very end of 2017 and much of the discussion happened in 2018 (as did the blog post by the originator of the pull request that is linked elsewhere in this thread.)

I'm not really sure what the policy is when the linked content spans the new year.

Comments do not make the original post. We can have comments on some platforms for years after the OP. I think this way seems very logical, date the OP.

This led me to look at https://mostsecure.pw/

To my surprise that password isn't listed by Pwned Passwords. That's much more secure than I'd expected and I commend its creators for their outstanding work.

I'm a little ashamed that it took me about 30 seconds of staring at this page before I refreshed it and actually got the joke.

Good reminder to be careful using/trusting password generators online.

This was funny, liked the comments as well!

(not sure if serious discussion is expected here, so I will leave my useless comment as is!)

So long and thanks for all the fish.

> To add on to the translation of the idiom, that phrase literally means writing a sign that says "I did NOT bury 300 grand in this spot"

Awesome idiomatic phrase!

Thanks for posting this. I'm having a good laugh ... there's a lot of good humor in the comments on that issue.

Got to change my HN password from "dolphin" now. Can't believe they figured it out!

I changed mine to dolphin2. Better safe than sorry.

Liar!

Even better, d0lph1n

All I see is * * * * * *

six stars? that's my password!!

A pull-request is the wrong way to demand removal of personally-compromising information.
If he instead routes his request to Github’s GDPR compliance department, it will be illegal for them to refuse the deletion.

It was a joke. Pure trolling from a security researcher.

Voters seem to be missing gojomo's joke.

Indeed, but your joke detector needs further tuning, as it is only running at 50% accuracy in this thread.

Yep, I didn't get it. But I swear I didn't downvote you.

> A pull-request is the wrong way to demand removal of personally-compromising information.
> If he instead routes his request to Github’s GDPR compliance department, it will be illegal for them to refuse the deletion.
That's a good tip. If assafnativ ever wants to actually do that, I'm sure they will.
Which will of course also remove it from all the password dumps it was initially included in, and protect assafnativ from all future hacking attempts.

Even if it was safely deleted from Github, there's the rest of the Internet to worry about.
Definitely a great example of how the Streisand effect affects security.

Switch to KeePassXC on your Linux/Mac/Windows machine and an app that supports KDBX on your mobile device. For convenience, sync through iCloud or OwnCloud or whatever makes you happiest... and use KeePass's ability to create unique passwords on the fly for you, like this one:
{"5vb"9d"Q}+;FKy/N:)Hn3A#.'mJ$amkuWq%_pX

Let me just say this:
If you need to log into your google account on a weird touch screen device(looking at you, Honda's android auto implementation), do NOT have a super long random string password with a bunch of special characters in it. It will make your life hell whenever you have to type it. Its much easier to type in 8 words separated by dashes on a touch screen.

It's not hard to get KeepassXC to generate a medium-length alphanumeric password, which is IMO easier to tap-type than a passphrase, and it also has a passphrase generator.

Like hell I'd type my Gmail password into some presumably highly insecure software like a car audio system.

Yeah, this would be weird. Doesn't Android Auto just use the account that's already logged in on your phone?

Android Auto is essentially just using your car's screen as a remote display. I don't believe any of the real processing actually happens on your car's head unit. Your data doesn't get shared with the head unit at all.

> Your data doesn't get shared with the head unit at all.
As it should be.

Yeah, no, not doing that unless I get to security audit their code end-to-end. Have you seen the stories of auto APIs being completely unsecured, or just flat broken?
No password, no.

You are paranoid. Do you inspect every plane you board? Every car you ride in? Every room you sleep in?

The planes or cars most people ride in don't ask those details to be fair.

No, but I have read stories of auto APIs that are as broken as "change the user ID at the end of the request string, and you can see the entire account details of any other registered user".
That sort of incompetence makes me pause and think.

"I've read stories that people are able to take things out of cars if they're left unlocked."
Okay, got it...

False equivalency: When the manufacturer fails to secure PII, plus location history, plus control points of the car's internals, etc etc... that's far worse, more obscured, and much more in need of public disclosure than "door's unlocked, free contents!"

It's neither far worse, nor more in need of public disclosure, at all, because it's the exact same, consequentially. Literally, even! In order to take advantage of your "exposed" PII, the adversary needs physical access to your car.
Nothing false, it's actually equivalent.

Needing to link your car to your Google account already sounds like living in hell. ;)

I was actually trying to hack the head unit and it made my life easier by being able to log into google drive on the onboard browser and download some files.

Yes..These Google devices scares shit out of me.. to be honest.

you can create “app specific” passwords for situations like this
https://support.google.com/accounts/answer/185833?hl=en

It's designed for devices which cannot do Google's 2FA, not for normal use.

It's a joke. Not a 'real' PR.

Reply on news.ycombinator.com