Slashdot Mirror
Chrome Can Tell You if Your Passwords Have Been Compromised (engadget.com)
An anonymous reader shares a report: Given the frequency of hacks and data leaks these days, chances are good at least one of your passwords has been released to the wild. A new Chrome extension released by Google today makes it a little easier to stay on top of that: Once installed, Password Checkup will simply sit in your Chrome browser and alert you if you enter a username / password combination that Google "knows to be unsafe." The company says it has a database of 4 billion credentials that have been compromised in various data breaches that it can check against. When the extension detects an insecure password, it'll prompt you with a big red dialog box to immediately update your info. It's handy, but users might wonder exactly what Google can see -- to that end, Google says that the extension "never reveal[s] this personal information."
The correct way to go about it would be to advise users if their password is on known data breaches whether it is associated with the username or not. Otherwise this extension could be used to mine credentials out of whatever database google is using.
How does it work? Does it keep a local database of 4 billion compromised credentials and checks against them? Or, let me guess, it uploads all of my passwords to a Google-controlled server to check if they are secure? Hmm, I wonder what could go wrong with this plan.
Is the check done locally or does it query a remote db/host ? If it is the latter, it means that it transmits your password to a 3rd party. This is a big no-no for me.
If it tells me where the UID/Pwd combo exist, I can then change someone's password for them? That could be useful....
"I do not agree with what you say, but I will defend to the death your right to say it"
Google *can* see everything you do with Chrome - every click, every keystroke, every image you linger on a bit longer than is seemly. That capability is well within their ability, aka they *can* do it. The real question is how much of that they *choose* to collect and send back home, rather than simply having the ability to do so.
This seems like it should be benign enough though - not much advantage to be gained collecting this information (and a lot of potential liability and bad PR), and it's simple enough to hash a name/password combination and send it back to the server in order to retrieve any/all pairs with a matching hash for comparison on your computer.
--- Most topics have many sides worth arguing, allow me to take one opposite you.
Most useful if it also stops people from using 1234567 as their password
excitingthingstodo.blogspot.com
Google Security Blog Info.
Chrome Extension
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
Anyone with a copy of Google's back end database (such as an intelligence service) and who is also able to intercept the database query, will know your password.
If I need a throwaway or temporary account, can it hook me up?
Velociraptor = Distiraptor / Timeraptor
I'll monitor my own shit thank you. I trust YOU (Google) even less than the bad guys.
Digital is, by definition, imperfect. Analog is the way to go.
Exactly why you shouldn't trust google!
It could just upload a hash of your password... but even so I would not want my username going up with even just a hash to anywhere but where I am logging in.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
It's the old, "Please enter your credit card details and we'll check to see if they're compromised" trick, except they're just swiping the logins from the browser without going to the trouble of social engineering the user.
What protection does the user have when the device itself is the threat, and not some nefarious third party?
I got an email that took me to a web page where they offered to check all my username/password combinations. I'm happy to say I'm good, no matches found.
Google is comparing against known username and passwords which means the passwords are salted and hashed.
When you put in a username and password, it's salts and hashes the same and then checks the database.
They don't need your plaintext password to check since they have the plaintext compromised passwords.
That allows them to hash both in a known secure method.
Work Safe Porn
Doesn't make much sense to wait for a user to go to a site to alert him if his credentials have been compromised.
It seems to me it would make more sense for Chrome to *proactively* go over all of the credentials **it has already saved locally and knows about** and provide the user with a report showing which are known to have been compromised. If I only go to Yahoo Mail (I know, I know, just an example) once a month, then why wait a month for me to go to the site when they already have the credentials that could be checked at any time (since they've been saved and Chrome knows how to decrypt--since it can autofill them)?
HASHING. LOOK IT UP.
Troy Hunt has a really nice solution for this on his HaveIBeenPwned site. He has an API that allows you to submit a partial hash of your password (the first half of the SHA1 of your password) and then the API returns a list of complete hashes that have appeared in a breach. You can check it out his about page here.
The reasoning is that you are not providing your complete password hash, so both his site and an eavesdropper would not know if your password actually appears in that list or not. Only you know, and the list that is returned averages about 450-500 complete hashes. It would give an attacker with a rainbow table a starting point, but then you'd also know if your password appears in a dictionary or breach and should be changed.
The Daddy casts sleep on the Baby. The Baby resists!
They run entirely counter to everything we know about security.
> Give us your login ID and password and we'll tell you whether they've been compromised. (snicker, snicker)
type, type, type. Submit.
> Yup, that one's been compromised now. Give us another one.
type, type, type. Submit.
> Yup, that one's been compromised now. Give us another one. How about your bank this time?
Hell no.
Trust your passwords to data miners? Even after their "we didn't mean to do it" escapade of scanning everyone's wifi while driving by with the google maps car.
About done with Chrome all the way. Currently posting with Firefox, it's gotten a lot better again.
...NSA^H^H^HGoogle.
Way back when HTML was invented they specified an input type that browsers aren't even supposed to show on screen. The web wasn't secure, and a password input field didn't make anything safe, but it at least recognized the over the shoulder attack.
Since then web site operators have been doing things to attempt to make your communication with them more secure, various Javascript handlers and encrypted connections, etc. Of course these things range from well implemented to actually less secure, but at least the security or lack thereof was between you and the web site.
Now Google is actually releasing an official extension that is scraping those password fields on every website and handing off to a backend processor. I imagine that Google is passing hashes around, via an encrypted channel, but the fact is that at least on your computer that password exists in plain text in a browser extension that automatically processes every page you load.
They obviously can't put the database in the extension, so it has to pass identifiable information back to Google. Sure, it is encrypted information. Sure, it is probably some hash, not a clear text username and password, but it is a unique pair of tokens that have to remain unique going to a monstrous company along with a few billion other peoples unique identifiable tokens. Your password is no longer between you and the website, it is between you and the website and google.
I can't even find words.
There is now an attack surface which includes all of your web passwords. An efficient password harverter no longer has to look for vulnerabilities in Drupal, and WordPress, and PHPBB, and your favorite JS framework of the week, they have a single target to rule them all.
Geez, why don't we just issue goveernment assigned passwords with social security numbers at birth, It would be more convenient for everyone.
If Google wants to utilize this big dictionary of exploited passwords they should build a proper website where a person can go and type in their username and password, with clearly worded information explaining exactly what people are submitting and what will be done with it, and people can choose if they want to check their user/pass combinations.
I suppose the next thing they wil do with this extension is build a database of the most common actual passwords in use, stripped of usernames of course, so they can publish the authoritative list of passwords not to pick.
"Proximity to wonder has blunted our perception and appreciation of it" --Tim Hartnell in 'Exploring ARTIFICIAL INTELLI
>how do you test for existence of a record in a database without bleeding out what you are checking?
Easy.
1) You take the username+password pair to be tested and feed them through an irreversible hashing algorithm to generate a pseudo-random number
2) You query the database server for all compromised credentials matching that number
3) The server sends back any matches, encrypted for added security if you want
4) You compare all the potential matches found against your actual username and password.
If your credentials aren't in the database, then there's no way to figure out what they actually are from the information transferred between computers
If your credentials *are* in the database, then they're already public knowledge, and leaking them further has no effect. (other than possibly identifying you as the account user - which is really the only reason you'd want encryption in step 3)
--- Most topics have many sides worth arguing, allow me to take one opposite you.
It can also tell us that Trump and both his campaign and administration have been compromised by the Russians by serving up legitimate news sites and blocking propaganda sites like Fox News.
What they SAY they're doing and what they ARE doing are likely Apples and Oranges.