Schneier on Security

MARCH 2, 2023

Troy Hunt is collecting examples of dumb password rules. My worst experiences are with sites that have artificial complexity requirements that cause my personal password-generation systems to fail. There are some pretty bad disasters out there.

Passwords 63

Passwords 63

Krebs on Security

AUGUST 19, 2024

KrebsOnSecurity has learned that another NPD data broker which shares access to the same consumer records inadvertently published the passwords to its back-end database in a file that was freely available from its homepage until today. In April, a cybercriminal named USDoD began selling data stolen from NPD.

Passwords 359

Passwords Data breaches Accountability Data privacy 359

Schneier on Security

OCTOBER 12, 2022

Researchers have used thermal cameras and ML guessing techniques to recover passwords from measuring the residual heat left by fingers on keyboards. From the abstract: We detail the implementation of ThermoSecure and make a dataset of 1,500 thermal images of keyboards with heat traces resulting from input publicly available.

Passwords 344

Passwords 344

Schneier on Security

OCTOBER 11, 2023

This is not the first time Cisco products have had hard-coded passwords made public. A successful exploit could allow the attacker to log in to the affected system and execute arbitrary commands as the root user. You’d think it would learn.

Passwords 355

Passwords Accountability 355

Krebs on Security

OCTOBER 13, 2021

A recent phishing campaign targeting Coinbase users shows thieves are getting cleverer about phishing one-time passwords (OTPs) needed to complete the login process. In each case, the phishers manually would push a button that caused the phishing site to ask visitors for more information, such as the one-time password from their mobile app.

Passwords 353

Passwords Phishing Accountability Mobile 353

Troy Hunt

MARCH 9, 2022

Which led me to a moment of clarity just yesterday as I was pondering revenge tactics and, in a flash of inspiration, came up with the idea of Password Purgatory: purgatory: a place or state of temporary suffering or misery You know how we all hate password complexity criteria? All they have to do first is create a password.

Passwords 345

Passwords DNS Accountability Risk 345

Schneier on Security

SEPTEMBER 26, 2022

Sometimes browser spellcheckers leak passwords : When using major web browsers like Chrome and Edge, your form data is transmitted to Google and Microsoft, respectively, should enhanced spellcheck features be enabled.

Passwords 322

Passwords Insurance Banking 322

Troy Hunt

MAY 27, 2021

Both these announcements are being made at a time where Pwned Passwords is seeing unprecedented growth: Getting closer and closer to the 1B requests a month mark for @haveibeenpwned 's Pwned Passwords. Speaking of natural fits, Pwned Passwords is perfect for this model and that's why we're starting here.

Passwords 358

Passwords Accountability Cybercrime Authentication 358

Krebs on Security

SEPTEMBER 29, 2021

In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. An ad for the OTP interception service/bot “SMSRanger.”

Passwords 351

Passwords Mobile Authentication Banking 351

Schneier on Security

FEBRUARY 1, 2023

This is the result of a security audit: More than a fifth of the passwords protecting network accounts at the US Department of the Interior—including Password1234, Password1234!, and ChangeItN0w!—were

Passwords 282

Passwords Accountability Authentication Government 282

Krebs on Security

SEPTEMBER 22, 2023

The password manager service LastPass is now forcing some of its users to pick longer master passwords. But critics say the move is little more than a public relations stunt that will do nothing to help countless early adopters whose password vaults were exposed in a 2022 breach at LastPass.

Passwords 303

Passwords Encryption Password Management Cryptocurrency 303

Troy Hunt

AUGUST 3, 2022

So, earlier this year I created Password Purgatory with the singular goal of putting spammers through the hellscape that is attempting to satisfy really nasty password complexity criteria. I opened-sourced it, took a bunch of PRs, built out the API to present increasingly inane password complexity criteria then left it at that.

Passwords 363

Passwords Accountability 363

Troy Hunt

FEBRUARY 9, 2023

I think I've pretty much captured it all in the title of this post but as of about a day ago, Pwned Passwords now has full parity between the SHA-1 hashes that have been there since day 1 and NTLM hashes. So, Chief Pwned Passwords Wrangler Stefán Jökull Sigurðarson got to work and just went ahead and built it all for you.

Passwords 310

Passwords 310

Troy Hunt

DECEMBER 7, 2021

He's not a techie (he runs a pizza restaurant), but somehow, we ended up talking about passwords. Change the password to one 1Password automatically generates c. Obviously, he still has a heap of accounts to set decent passwords on, but now he knows the pattern and he can repeat that over and over again.

Passwords 338

Passwords Password Management Banking Accountability 338

Troy Hunt

MAY 19, 2022

Just before Christmas, the promise to launch a fully open source Pwned Passwords fed with a firehose of fresh data from the FBI and NCA finally came true. I'm also conscious that to make this tool more useful, it would be handy to know when to actually run it by seeing how many new password hashes have been added since a given date.

Passwords 304

Passwords 304

Tech Republic Security

JUNE 3, 2024

Here are 5 reasons why you should consider using a password manager to protect your data and improve password management.

Password Management 193

Password Management Passwords 193

Tech Republic Security

JULY 9, 2024

Nearly 10 billion passwords have been leaked on a popular hacking forum, according to Cybernews.

Passwords 212

Passwords Hacking Big data 212

Tech Republic Security

OCTOBER 28, 2024

Like other password managers, there are risks and drawbacks to consider before trusting Firefox Password Manager with your credentials.

Password Management 166

Password Management Passwords Risk 166

Tech Republic Security

JUNE 5, 2024

Are password managers safe to use? Find out if they are really secure and discover the benefits and risks of using password managers.

Password Management 185

Password Management Passwords Risk 185

Tech Republic Security

OCTOBER 1, 2024

If you’re curious about how to create a secure password, read our in-depth guide covering password security and best practices.

Passwords 182

Passwords 182

Tech Republic Security

SEPTEMBER 27, 2024

Google Password Manager is a free password management service built into Chrome and Google apps. Learn how it works and how secure it is in this detailed review.

Password Management 175

Password Management Passwords 175

Tech Republic Security

OCTOBER 2, 2024

Need to share a Wi-Fi password with a friend or coworker? Learn how to share a Wi-Fi password on iPhones, iPads, Macs, Androids, and Windows computers.

Passwords 176

Passwords 176

Security Affairs

NOVEMBER 3, 2024

Microsoft warns Chinese threat actors are using the Quad7 botnet to carry out password-spray attacks and steal credentials. Chinese threat actors use the Quad7 botnet in password-spray attacks to steal credentials, Microsoft warns. ” concludes Microsoft.

Passwords 133

Passwords Wireless VPN Accountability 133

Tech Republic Security

DECEMBER 2, 2024

Bitwarden’s excellent free version makes it one of the best free password managers available. To learn more, read our full Bitwarden review.

Password Management 131

Password Management Passwords 131

Troy Hunt

JANUARY 17, 2024

Website, username and password: That's just the first 20 rows out of 5 million in that particular file, but it gives you a good sense of the data. The question of how valid the accompanying passwords remain aside, time and time again the email addresses in the stealer logs checked out on the services they appeared alongside.

Passwords 352

Passwords Password Management Hacking Accountability 352

Tech Republic Security

DECEMBER 11, 2024

Keepers extensive authentication options and generous discounts make it an alluring password manager to try this year. Read more about it in our full review.

Password Management 123

Password Management Passwords Authentication 123

Schneier on Security

SEPTEMBER 18, 2023

Remember last November, when hackers broke into the network for LastPass—a password database—and stole password vaults with both encrypted and plaintext data for over 25 million users? Look, I know that online password databases are more convenient. This is why my Password Safe is local only. (I

Cryptocurrency 313

Cryptocurrency Hacking Passwords Encryption 313

Krebs on Security

JULY 29, 2021

Every time there is another data breach, we are asked to change our password at the breached entity. Our continued reliance on passwords for authentication has contributed to one toxic data spill or hack after another.

Passwords 362

Passwords Password Management Phishing Scams 362

Daniel Miessler

DECEMBER 24, 2022

The initial blog was on August 25th, saying there was a breach, but it wasn’t so bad because they had no access to customer data or password vaults: Two weeks ago, we detected some unusual activity within portions of the LastPass development environment. And specifically, asking me whether I used LastPass or any other password manager.

Password Management 364

Password Management Passwords Encryption Backups 364

Troy Hunt

FEBRUARY 4, 2024

That's not unprecedented, but this is: password: "$2y$10$B0EhY/bQsa5zUYXQ6J.NkunGvUfYeVOH8JM1nZwHyLPBagbVzpEM2", No way! Is that genuinely a bcrypt hash of my own password? Yep, that's exactly what it is : The Spoutible API enabled any user to retrieve the bcrypt hash of any other user's password.

Passwords 363

Passwords Accountability Backups Data breaches 363

Troy Hunt

MAY 29, 2024

unique passwords provided by law enforcement agencies into Have I Been Pwned (HIBP) following botnet takedowns in a campaign they've coined Operation Endgame. The only data we've been provided with is email addresses and disassociated password hashes, that is they don't appear alongside a corresponding address.

Passwords 324

Passwords Password Management Data breaches Cybercrime 324

Schneier on Security

DECEMBER 26, 2022

Last August, LastPass reported a security breach, saying that no customer information—or passwords—were compromised. These encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password using our Zero Knowledge architecture.

Passwords 300

Passwords Encryption Backups Password Management 300

Schneier on Security

JUNE 28, 2022

Thought experiment story of someone of someone who lost everything in a house fire, and now can’t log into anything: But to get into my cloud, I need my password and 2FA. To get my passwords, I need my 2FA. To get my 2FA, I need my passwords. I am in cyclic dependency hell. There is no-one to convince. Code is law.

Passwords 315

Passwords Password Management Backups Risk 315

Krebs on Security

SEPTEMBER 5, 2023

In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. 15, 2022, LastPass said an investigation into the August breach determined the attacker did not access any customer data or password vaults.

Cryptocurrency 362

Cryptocurrency Passwords Encryption Accountability 362

Troy Hunt

MARCH 9, 2023

that was out of a total of more than 166M requests in the same period: Yep, we just hit "five nines" of cache hit ratio on Pwned Passwords being 99.999%. It also means that the 48c per day cost is going to come way down 🙂 Every time the FBI feeds new passwords into the service , the impacted file is purged from cache.

Passwords 336

Passwords Accountability 336

Troy Hunt

JUNE 5, 2021

This week has been absolutely dominated by code contributions to Pwned Passwords. The challenge I have now is, as expected, managing the pull requests, reviewing code and ensuring the project heads in the right direction as support for ingesting the FBI -provided passwords is built out.

Passwords 360

Passwords 360

Schneier on Security

DECEMBER 2, 2022

No passwords were compromised. The company was hacked , and customer information accessed.

Passwords 318

Passwords Hacking 318