Joerg-Neo900 | xmn: absolutely, yes | 03:27 |
---|---|---|
Joerg-Neo900 | sixwheeledbeast: interesting | 03:40 |
DocScrutinizer05 | my root password had 6 hits | 05:10 |
xmn | oops | 05:15 |
atk | no hits on anything important | 07:56 |
atk | an old old old password I used | 07:56 |
atk | which is generic enough to have been used by lots of other people | 07:57 |
atk | 5140 matches :D | 07:57 |
DocScrutinizer05 | don't use the web interface at https://passwordsecurity.info/ ! https://github.com/technonerdz/passwordsecurity.info/issues/6 | 08:39 |
DocScrutinizer05 | or if you do, c&p the password so only one query with full length passowrd gets generated | 08:40 |
xmn | do you guys feel safe using this with your passwords? | 08:45 |
DocScrutinizer05 | yes, the local shellscript is safe | 08:49 |
DocScrutinizer05 | the web interface is NOT !!! | 08:49 |
xmn | yeah, so the local one hashs your password and then check it against their database right? | 09:01 |
Joerg-Neo900 | xmn: right | 09:11 |
Joerg-Neo900 | actually it also truncates the hash to leading 5 chars | 09:11 |
Joerg-Neo900 | thanks to max-p of PIA for helping with the analysis of the web interface | 09:17 |
atk | I didn't use the shellscript or the web-interface | 09:21 |
atk | I just manually generated the hash and manually made the web requests | 09:21 |
atk | I know there isn't much in that shell script, but who the fuck knows, I don't know bash that well, might be here's some missing character somewhere which would cause things to be interpreted "incorrectly" | 09:22 |
sixwheeledbeast | Yes it hashes the password and only sends the first 5 chars of the sha1 to the api. You receive the sha's that match and compare locally is how I read it. I assume I am reading the source of the script correctly and there is nothing else in there. | 09:27 |
Joerg-Neo900 | atk: the true geek's approach :-) | 09:28 |
sixwheeledbeast | The website (HIBP) can work the same if you sha1 your password first I believe but the website source would need checking each time. My only concern is bash will log the password in plaintext locally. | 09:29 |
sixwheeledbeast | Time to change your root password I think Doc | 09:30 |
Joerg-Neo900 | how and where/why would bash log any of that? | 09:30 |
Joerg-Neo900 | of course my rot pw got changed hours ago | 09:30 |
Joerg-Neo900 | :-) | 09:30 |
Joerg-Neo900 | been about time anyway | 09:30 |
sixwheeledbeast | If you run the script on the shell the plaintext will be in history | 09:31 |
Joerg-Neo900 | that's why my recommendation is to run the script without parameters and provide the pw on prompt | 09:31 |
sixwheeledbeast | and therefore ~/.bash_history | 09:31 |
sixwheeledbeast | I see, I haven't played with it much yet just used some known passwords in to check | 09:32 |
sixwheeledbeast | correcthorsebatterystaple for example | 09:33 |
Joerg-Neo900 | how many hits? :-D | 09:33 |
sixwheeledbeast | 114 | 09:34 |
Joerg-Neo900 | low | 09:34 |
sixwheeledbeast | I see so the prompt wouldn't be logged anywhere, the script will end therefore never stored to disk. | 09:36 |
Joerg-Neo900 | exactly. The usual way to deal with this, also used by passwd(1) | 09:37 |
sixwheeledbeast | yes logins etc. compare the first part of the hash | 09:38 |
xmn | cool, good info guys thanks | 09:41 |
sixwheeledbeast | It's a handy little script to have in your toolbox | 09:42 |
Joerg-Neo900 | sixwheeledbeast: >>...website (HIBP) can work the same if you sha1 your password...<< https://passwordsecurity.info/ does exactly same like script, incl generating SHA from plaintext password locally, according to Max-P's analysis | 09:44 |
sixwheeledbeast | I see it just hooks into the HIBP API. What are your concerns over the website versions? I personally wouldn't use a website for this as I would want to check over the source of the site each time I need it, it may have been compromised. | 09:48 |
Joerg-Neo900 | sixwheeledbeast: it does incremental search, thus the first query sent out is for exactly one out of max 256 chars, it's dead simple to reverse the hash to conclude the single char | 09:54 |
Joerg-Neo900 | the next query is for the hash of a 2char password, of which first char is known from last query | 09:54 |
Joerg-Neo900 | so again one out of 256 choices | 09:54 |
Joerg-Neo900 | this way you "recursively" or iteratively reveal the complete password from snooping HTML traffic as it is typed, in realtime | 09:56 |
sixwheeledbeast | oh I believed it would send the first part of the sha and match locally. Also site is https like the API to reduce risk of leaking the sha1 | 09:58 |
Joerg-Neo900 | yes, HTTPS defeats a worst case scenario here | 09:58 |
Joerg-Neo900 | it actually does >>send the first part of the sha and match locally<< | 09:59 |
Joerg-Neo900 | but that first 5 chars of SHA are more than sufficient to discern between 256 possible solutions to find the right one | 09:59 |
sixwheeledbeast | So similar risk with the API then? | 10:00 |
Joerg-Neo900 | no since the local version only does ONE query for full length password, no incremental search | 10:01 |
Joerg-Neo900 | the website does one query for each char you type | 10:01 |
sixwheeledbeast | oh I see, you can unhash each of the 5 sent chars for sure even without the rest of the hash | 10:02 |
sixwheeledbeast | not unhash | 10:02 |
Joerg-Neo900 | nah, those 5chars are truncated SHA sum, not truncated password | 10:02 |
xmn | sixwheeledbeast: makes a good point on that the site could be comprised at some other time. Where as the script will stay the same and hash locally. | 10:02 |
Joerg-Neo900 | 12345678X will still send a different truncated 5char hash than 12345678O | 10:04 |
sixwheeledbeast | I understand I am just not explaining verbosely. You have reduced the amount of hashs it isn't because it has been sent 1+2+3+4+5 times | 10:05 |
Joerg-Neo900 | !md5 s | 10:06 |
Joerg-Neo900 | ~md5 s | 10:06 |
infobot | 03c7c0ace395d80182db07ae2c30f034 | 10:06 |
Joerg-Neo900 | ~md5 sk | 10:06 |
infobot | 41d6ad0761a5d27a9e1bd567041ce9e9 | 10:06 |
Joerg-Neo900 | ~md5 skr | 10:06 |
infobot | 154211326b13dba32f059317703da7ed | 10:06 |
Joerg-Neo900 | ~md5 skri | 10:06 |
infobot | 624354d6b0d01595488285caba297009 | 10:07 |
Joerg-Neo900 | ~md5 skrit | 10:07 |
infobot | eaef5ef87d9b6c8b497acc64af3fdfcb | 10:07 |
Joerg-Neo900 | 03c7 41d6 1542 6243 eaef <- completely describes "skrit" | 10:08 |
* Joerg-Neo900 is fond of this terse explanation by example of above 11 lines :-) | 10:12 | |
atk | sixwheeledbeast: That's what I read from the shell script | 13:58 |
atk | sixwheeledbeast: but, I ... well | 13:59 |
atk | I just don't trust such things even when it's so obvious | 13:59 |
atk | I've seen IOCCC | 13:59 |
atk | I'm now going to be working in infosec as of next month | 13:59 |
atk | You can say I'm paranoid | 13:59 |
Joerg-Neo900 | so enjoy my augmented ticket ;-) https://github.com/technonerdz/passwordsecurity.info/issues/6 | 16:20 |
galiven_ | For bash at least, putting a space before the actual command won't log to ~./bash_history | 20:22 |
Generated by irclog2html.py 2.17.0 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!