Date: Wed, 16 May 2018 17:25:03 -0400 From: Matt Weir <cweir@...edu> To: passwords@...ts.openwall.com Subject: Re: Keeping old passwords > Did they? Can you post some links, please? Thanks for the [] comment! I need to dig around but I thought I had seen something about that in the past. It's possible I could be wrong though. On a related but different note, this is the best write-up I'm aware of for Facebook's hashing mechanism: http://bristolcrypto.blogspot.com/2015/01/password-hashing-according-to-facebook.html One plus side about digging into Google's research papers again is I can directly address e's comment with actual links. > especially when they have no information to make this decision. I'd like to highlight the following paper put out by Google: "Data breaches, phishing, or malware? Understanding the risks of stolen credentials" https://ai.google/research/pubs/pub46437 In it they talk about verifying stolen credentials found on hacking sites, user behavior when told to change their passwords, and percentage of users who get hacked multiple times. In short, lots of points that may be relevant to this conversation. Cheers, Matt On Wed, May 16, 2018 at 4:50 PM, Caleb White <Caleb.White@...c.edu> wrote: > > On 05/16/2018 4:14 PM, e wrote: >>especially when they have no information to make this decision. > > I'm the thoughtless "contributor" that Solar mentioned, so obviously I share your sentiments - but I'm sorry, in the example discussed Google absolutely has information to make that decision. Unless they are willing to make the dangerous assumption that Tor traffic is safe, this case must look extremely suspect based on the information they have. Most users probably only log in from a few IPs in a discrete geographic area - suddenly logging in from all around the world probably looks very similar to stuffing of breached credentials by many parties. > > I'm all for calling out Google on the ridiculous and anti-user things they do, but I feel that you are arguing from emotion and not reason in this specific case. > > Solar, there's no confusion - thank you for moderating these lists extremely well. I appreciate all you do for us, including reigning me in! > > Regards, > Caleb > > ________________________________ > > This e-mail, including any attachments, is intended only for the addressee's use and may contain confidential and proprietary information. If you are not the intended recipient, you are hereby notified that any retention, dissemination, reproduction, or use of the information contained in this e-mail is strictly prohibited. If you have received this e-mail by error, please delete it and immediately notify the sender. Thank you for your cooperation.
Powered by blists - more mailing lists
Powered by Openwall GNU/*/Linux - Powered by OpenVZ