Today I Learned
What did you learn today? Share it with us!
We learn something new every day. This is a community dedicated to informing each other and helping to spread knowledge.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules (interactive)
Rule 1- All posts must begin with TIL. Linking to a source of info is optional, but highly recommended as it helps to spark discussion.
** Posts must be about an actual fact that you have learned, but it doesn't matter if you learned it today. See Rule 6 for all exceptions.**
Rule 2- Your post subject cannot be illegal or NSFW material.
Your post subject cannot be illegal or NSFW material. You will be warned first, banned second.
Rule 3- Do not seek mental, medical and professional help here.
Do not seek mental, medical and professional help here. Breaking this rule will not get you or your post removed, but it will put you at risk, and possibly in danger.
Rule 4- No self promotion or upvote-farming of any kind.
That's it.
Rule 5- No baiting or sealioning or promoting an agenda.
Posts and comments which, instead of being of an innocuous nature, are specifically intended (based on reports and in the opinion of our crack moderation team) to bait users into ideological wars on charged political topics will be removed and the authors warned - or banned - depending on severity.
Rule 6- Regarding non-TIL posts.
Provided it is about the community itself, you may post non-TIL posts using the [META] tag on your post title.
Rule 7- You can't harass or disturb other members.
If you vocally harass or discriminate against any individual member, you will be removed.
Likewise, if you are a member, sympathiser or a resemblant of a movement that is known to largely hate, mock, discriminate against, and/or want to take lives of a group of people, and you were provably vocal about your hate, then you will be banned on sight.
For further explanation, clarification and feedback about this rule, you may follow this link.
Rule 8- All comments should try to stay relevant to their parent content.
Rule 9- Reposts from other platforms are not allowed.
Let everyone have their own content.
Rule 10- Majority of bots aren't allowed to participate here.
Unless included in our Whitelist for Bots, your bot will not be allowed to participate in this community. To have your bot whitelisted, please contact the moderators for a short review.
Partnered Communities
You can view our partnered communities list by following this link. To partner with our community and be included, you are free to message the moderators or comment on a pinned post.
Community Moderation
For inquiry on becoming a moderator of this community, you may comment on the pinned post of the time, or simply shoot a message to the current moderators.
view the rest of the comments
I don't know if I want to be putting my passwords in to something like this lol
If you’re worried, send them to me and I’ll check for you.
hunter2
FYIL hunter2 was used by 65,744 accounts. hahaha
I am both impressed and horrified by this fact.
oh fuck me
Yeah that one is used, you should change it
I just see *******
Oh lol that one is old
yezzir
Password123!
FYI: Password123! was used by 293,751
very sane reaction.
I have to say though, haveibeenpwned is very well regarded in the industry, and is run by a well known security expert. A leak from there would be quite the blow to his reputation.
https://en.wikipedia.org/wiki/Have_I_Been_Pwned
That said, while I happily give them my email-addresses, I have never given them my password.
I’m not so sure that it would be a huge blow. He’s only human and everyone is susceptible to the odd mistake.
He did get phished last year and blogged about it after it happened which is the transparent approach that security experts say is the correct response. I’m pleased that he followed the advice that he gives to be honest and don’t think any less of him for suffering a breach.
https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/
Fair, I misstated that. A deliberate leak from there would be quite the blow to his reputation.
All it takes is a malicious actor to MITM or a compromised codebase or any other malicious things to slip in something and its also pwned.
I've seen too many widely recognized and supposedly secure things fail, to trust this with my passwords.
I'd argue though, if you use a single password for everything, its probably more secure to add it here to at least get an indication when it's breached. Your surface in that case is already so large that the difference is negligible compared to the gained warning.
That said, don't reuse passwords!
I suppose they use JavaScript to hash your password locally so all haveibeenpwned has is your hash.
It's certainly not full proof but it means a simple MITM attack wouldn't be that bad.
The risk would be that the JavaScript in question would be compromised for the whole service. Also if the machine of the user is already compromised well I would argue that password is already useless anyway. If someone has a keylogger on your system, ihavebeenpwnd would be the least of your concern.
So it's never foolproof but some risk can be mitigated.
Hashes are a powerful tool enabling easy check of leaks without exposing directly any user password.
Edit: Hmm there is much better explanations than mine on hashes on here, probably disregard the above comment.
I hope for humanity's sake that you're joking.
Why?
Same person said that to me too and refuses to elaborate. Really strengthens their argument.
Because using a reputable k-anonymity service is as risky as throwing apple peels in the trash. Or just looking at an apple.
I'd argue it's generally a very sane reaction to instinctively say no when some service you don't know about wants your password.
The commentor you replied to obviously didn't know about the pedigree of haveibeenpwned beforehand
It makes a cryptographically-secure hash of the password you enter, then truncates that before sending it to the server so the only information they get would be in common with a huge number of other passwords. They then send back the leaked passwords with the same truncated hash, and your computer checks to see if what you've entered matches anything on the list. It's not practical to send the whole list for every query as there's just too much data, but if you don't trust their site, you can just download the whole list and check against it yourself.
Yeah its fine to look through a list but not going to put in my stuff.
My god you people 😂😂😂
https://lemmy.ca/comment/21535992
which is fine but there is a trust chain or a big homework assignment for me to be comfortable with it.
You enter your password in thousands of websites. Why is this one different?
not sure about thousands. I only have so many accounts. Maybe hundreds. but their all different. admitadely that is part of it. this feels like a problem from for me would be the aughts which was before I was using password managers.
Use a different VPN server and private mode on each. Easy.
You think people that tech illiterate have any idea how to use a VPN?
I know how to use one. Ive got no idea how to verify that its trustworthy.
Sadly, I know they usually don't.
https://lemmy.ca/comment/21535992
Holy tech illiteracy batman
Thanks for the explanation. Really makes me want to do it even more.
Deleted by author