Remove my password from lists so hackers won't be able to hack me (2017)

https://github.com/danielmiessler/SecLists/pull/155

by srathi • 7 years ago

160 55 7 years ago

mikece• 7 years ago

Switch to KeePassXC on your Linux/Mac/Windows machine and an app that supports KDBX on your mobile device. For convenience, sync through iCloud or OwnCloud or whatever makes you happiest... and use KeePass's ability to create unique passwords on the fly for you, like this one:

{"5vb"9d"Q}+;FKy/N:)Hn3A#.'mJ$amkuWq%_pX

farisjarrah2• 7 years ago

Let me just say this:

If you need to log into your google account on a weird touch screen device(looking at you, Honda's android auto implementation), do NOT have a super long random string password with a bunch of special characters in it. It will make your life hell whenever you have to type it. Its much easier to type in 8 words separated by dashes on a touch screen.

Mathnerd314• 7 years ago

It's not hard to get KeepassXC to generate a medium-length alphanumeric password, which is IMO easier to tap-type than a passphrase, and it also has a passphrase generator.

jankiehodgpodge• 7 years ago

Like hell I'd type my Gmail password into some presumably highly insecure software like a car audio system.

zentiggr3• 7 years ago

Yeah, no, not doing that unless I get to security audit their code end-to-end. Have you seen the stories of auto APIs being completely unsecured, or just flat broken?

No password, no.

dessant• 7 years ago

Needing to link your car to your Google account already sounds like living in hell. ;)

bdcravens• 7 years ago

you can create “app specific” passwords for situations like this

https://support.google.com/accounts/answer/185833?hl=en

alanfranz3• 7 years ago

It's a joke. Not a 'real' PR.

eranation• 7 years ago

Previous discussion: https://news.ycombinator.com/item?id=16009459

Also see: http://blog.assafnativ.com/2018/02/dolphins.html

shkkmo2• 7 years ago

Yes, the title should specify 2018

pc86• 7 years ago

The page is from 2017.

TimTheTinker• 7 years ago

Thanks for posting this. I'm having a good laugh ... there's a lot of good humor in the comments on that issue.

sdan• 7 years ago

Got to change my HN password from "dolphin" now. Can't believe they figured it out!

jspash• 7 years ago

I changed mine to dolphin2. Better safe than sorry.

diminoten4• 7 years ago

Liar!

TwoHeadedBeast• 7 years ago

Even better, d0lph1n

philjohn• 7 years ago

All I see is * * * * * *

Reply

em-bee• 7 years ago

six stars? that's my password!!

Reply

pseudosavant• 7 years ago

So long and thanks for all the fish.

Reply

sysashi• 7 years ago

This was funny, liked the comments as well!

(not sure if serious discussion is expected here, so I will leave my useless comment as is!)

Reply

mundu_wa_hinya2• 7 years ago

Reminds me of bash.org's hunter2 snip. http://bash.org/?244321=

Reply

jdoliner2• 7 years ago

If you do a search in the repo you'll find that hunter2 remains a commonly used password.

Reply

mundu_wa_hinya2• 7 years ago

Oh wow! I'll have to start grepping for hunter2 everywhere....

Reply

jcrawfordor• 7 years ago

I regularly use hunter2 as the example or test value for passwords/keys. I wonder how many other people do this, and how many times it's accidentally leaked into production...

Reply

jdoliner2• 7 years ago

I don't see my password on the list, but I want to make sure it stays that way. I wonder if they'd be willing to add a list of passwords never to be included on any list so as to keep their users safe.

Reply

Hello71• 7 years ago

https://en.wikipedia.org/wiki/Russell%27s_paradox

Reply

gojomo2• 7 years ago

A pull-request is the wrong way to demand removal of personally-compromising information.

If he instead routes his request to Github’s GDPR compliance department, it will be illegal for them to refuse the deletion.

Reply

alanfranz3• 7 years ago

It was a joke. Pure trolling from a security researcher.

Reply

re• 7 years ago

Voters seem to be missing gojomo's joke.

Reply

gojomo2• 7 years ago

Indeed, but your joke detector needs further tuning, as it is only running at 50% accuracy in this thread.

Reply

reificator• 7 years ago

A pull-request is the wrong way to demand removal of personally-compromising information.
If he instead routes his request to Github’s GDPR compliance department, it will be illegal for them to refuse the deletion.

That's a good tip. If assafnativ ever wants to actually do that, I'm sure they will.

Which will of course also remove it from all the password dumps it was initially included in, and protect assafnativ from all future hacking attempts.

Reply

Shorel2• 7 years ago

Even if it was safely deleted from Github, there's the rest of the Internet to worry about.

Definitely a great example of how the Streisand effect affects security.

Reply

magnat• 7 years ago

There was this spoofed page that looked just like plain, unordered text file of passwords, that intercepted ctrl-f, displayed searchbox look-alike based on your user-agent and generated entries to match the password you are typing, so it looked as if your password was there. Anyone happens to remember the URL?

Reply

Shorel2• 7 years ago

Damn this is pure evil.

Reply

RcouF1uZ4gsC• 7 years ago

To add on to the translation of the idiom, that phrase literally means writing a sign that says "I did NOT bury 300 grand in this spot"

Awesome idiomatic phrase!

Reply

tialaramex• 7 years ago

This led me to look at https://mostsecure.pw/

To my surprise that password isn't listed by Pwned Passwords. That's much more secure than I'd expected and I commend its creators for their outstanding work.

Reply

danShumway• 7 years ago

I'm a little ashamed that it took me about 30 seconds of staring at this page before I refreshed it and actually got the joke.

Good reminder to be careful using/trusting password generators online.

Reply

Remove my password from lists so hackers won't be able to hack me (2017)

Related Stories