[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJ9ii1GFCdDfO-E8sHauTbwfopLGfG2+TN8z=tN-tgvX2jMHjw@mail.gmail.com>
Date: Wed, 16 May 2018 17:25:03 -0400
From: Matt Weir <cweir@...edu>
To: passwords@...ts.openwall.com
Subject: Re: Keeping old passwords
> Did they? Can you post some links, please?
Thanks for the [[citation needed]] comment! I need to dig around but I
thought I had seen something about that in the past. It's possible I
could be wrong though. On a related but different note, this is the
best write-up I'm aware of for Facebook's hashing mechanism:
http://bristolcrypto.blogspot.com/2015/01/password-hashing-according-to-facebook.html
One plus side about digging into Google's research papers again is I
can directly address e's comment with actual links.
> especially when they have no information to make this decision.
I'd like to highlight the following paper put out by Google: "Data
breaches, phishing, or malware? Understanding the risks of stolen
credentials"
https://ai.google/research/pubs/pub46437
In it they talk about verifying stolen credentials found on hacking
sites, user behavior when told to change their passwords, and
percentage of users who get hacked multiple times. In short, lots of
points that may be relevant to this conversation.
Cheers,
Matt
On Wed, May 16, 2018 at 4:50 PM, Caleb White <Caleb.White@...c.edu> wrote:
>
> On 05/16/2018 4:14 PM, e wrote:
>>especially when they have no information to make this decision.
>
> I'm the thoughtless "contributor" that Solar mentioned, so obviously I share your sentiments - but I'm sorry, in the example discussed Google absolutely has information to make that decision. Unless they are willing to make the dangerous assumption that Tor traffic is safe, this case must look extremely suspect based on the information they have. Most users probably only log in from a few IPs in a discrete geographic area - suddenly logging in from all around the world probably looks very similar to stuffing of breached credentials by many parties.
>
> I'm all for calling out Google on the ridiculous and anti-user things they do, but I feel that you are arguing from emotion and not reason in this specific case.
>
> Solar, there's no confusion - thank you for moderating these lists extremely well. I appreciate all you do for us, including reigning me in!
>
> Regards,
> Caleb
>
> ________________________________
>
> This e-mail, including any attachments, is intended only for the addressee's use and may contain confidential and proprietary information. If you are not the intended recipient, you are hereby notified that any retention, dissemination, reproduction, or use of the information contained in this e-mail is strictly prohibited. If you have received this e-mail by error, please delete it and immediately notify the sender. Thank you for your cooperation.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
