Hacker News Reader

Comment by pbreit | Hacker News Reader

Now there's a great idea! Provide your password to some random site purporting to check if your password's been compromised.

View on HN

http://www.inutile.ens.fr/estatis/password-security-checker/

(BTW, be sure to type some gibberish into the provided box and hit submit, so you can see why I think this is a very relevant link.)

The Terms and Conditions are hilarious:

c. You agree to pay $ 100,000 for your use of the Estatis Free Password Security Checker if we ever ask for it.

"All States shall be entitled to lay submarine cables and pipelines on the bed of the high seas."

oh dear.

That's the Geneva convention. It's right after a chapter of Frankenstein.

Is that a Masonic Chapter? Did that happen before or after they started the alamo?

That's a much better link than the one I've been using: http://twitterphishr.com/

Bonus points for those who submit, read what it presented then proceeded to test another password!

They got me a second time with "Test another password?"

They have a bug. Type a " character and it gets encoded with a backslash in the output.

This is fixed. Thanks :-).

Even if you don't check the source code to verify that it's harmless, you should assume your password has been compromised and have already changed it anyway. This just lowers the cost of checking the list and could help us learn more about the compromise.

If the hole that let them in hasn't been closed yet, changing the password will make that password vulnerable, right?

LinkedIn said:

> users who have already changed their passwords or created a new account won’t have to worry, as they have recently begun hashing and salting their current password databases.

http://techcrunch.com/2012/06/06/linkedin-speaks-some-of-tho...

"recently"?!?

Yes, it could have been a little earlier but from what it seems, it was before the leak.

In other news I have a startup on credit card security

Just submit your credit card number, CVV2 and expiration date and it'll check if it has been stolen over the internet for you

Oh, I think I know you. You're that Nigerian prince I keep getting emails from, right?

Will you be directing the form submission page to a static HTML page reading "Yes"?

Hate to say it, but someone executed on this before you: http://ismycreditcardstolen.com/

I'm not worried, mine is "Social"

Cool, does it use Web 2.0 and have an API?

"Kara's credit card has been stolen :(" 4 likes

You can supply just your password hash if you want, and if you supply the raw password, it's hashed client-side via Javascript before being sent to the server. Test it out with firebug and a dummy password if you're not keen on wading through the source.

Still, hashes can be cracked, and an evil password-checking website can then associate the password with all of the other personally-identifiable data that browsers are known to leak. I don't think this particular site is being evil, but it would be wrong for a user to trust a site like this.

Again, you can check the source. It's a single page for a reason ;-). There's no trickery hidden in there.

I mean server-side (can we check the source for that?). The server could crack the hash, and the server could use various pieces of data (ip address, http headers, etc) to try to figure out more about the password's owner.

True, that's completely possible. However, if this concerns you then you should probably not sign up for any account on any site, since they could be doing the very same thing with your actual password.

Which is why you use different passwords on different sites.

Maybe no trickery hidden in there now, but that could change any time. Or sometimes. Or depending on IP, browser or OS.

And even if there's no "trickery" from the hosting site, they're slurping in javascript from a 3rd party down the bottom (getclicky). That means they (or anybody who compromises them) could grab the cleartext passwords from the form before the inline javascript does it's sha1 hashing…

What would be good is to have the 'checking request' return a json (or just a short info) and not a whole html

Just change your password before checking. You should've had already, anyway.

I saw a spam once that said "Is your husband's password compromised? Check it on this site ..." clearly trying to social engineer a spouse into 'doing a favor.'

These people can be very very very evil.

If you don't particularly trust the included click.js script, you can generate your password's SHA-1 via python fairly easily

   python -c 'import hashlib; print hashlib.sha1("PaSSw0rd").hexdigest()'

or easier and shorter:

   printf PaSSw0rd | sha1sum

Or call shasum or sha1sum and input your password on stdin so your shell history doesn't contain your password in plain text.

Just pop a space at the beginning and it won't go into shell history.

It does for me

  >  echo test
  test
  > history
  ...
  6730   echo test
  6731  history

Set this in your .bashrc

  HISTCONTROL=ignorespace

Or even better, though unrelated to this topic... Also get it to ignore duplicates that come next to each other.

  HISTCONTROL=ignoredups:ignorespace

That's a bash-ism that's controlled by the $HISTCONTROL environment variable, not universally-applicable advice. $HISTCONTROL set to "ignorespace" or "ignoreboth" may or may not be the default, depending on your distribution.

Yeah already replied below specifying that - I was under the impression that it's default to on in most distros, but don't actually have a clue which do/don't.

it will still be in ps output for a short while...

Ultra paranoid. I like the way you think.

    python -c 'import hashlib; from getpass import getpass; s = hashlib.sha1(); s.update(getpass()); print s.hexdigest()'

how do you get rid of the carriage return as last char that way?

Use Ctrl-d to end input without hitting return and you shouldn't get a newline.

bash, at least, only handles Ctrl-d on its own line.

If you're not on a new line, you can type Ctrl-d twice.

What if my password contains % characters?

Yeah, note that this doesn't work with all password combinations. I just use the Python version above

  python -c 'import hashlib; print hashlib.sha1("reALpassWORD12%12").hexdigest()'

and then:

  history -d $((HISTCMD-2))

to delete the last entry in the bash history.

Add a `from getpass import getpass` in there, replace your password with `getpass()`, and you'll be set :)

I assumed this website was a joke. I'm surprised it isn't.

http://ismycreditcardstolen.com/

hunter2

correct horse battery staple.

Years ago, 1996, we had a border router that we inherited and didnt have the password to, nor any way to get it. It was in production and we needed to get the password without killing the config.

David Sifry (founder of linuxcare) was my consultant on the issue - he was able to recover the password after some effort. I'll never forget what it was: Feet4monkey

Your post reminded me of that.

My password is 'password1' and it's on that list... Yikes.

You guys have no sense of humor.

Reply on news.ycombinator.com