"Threat actors could exploit the RockYou2024 password compilation to
conduct brute-force attacks and gain unauthorized access to various online accounts used by individuals who employ passwords included in the dataset," the team explained.
On 2024-07-06 19:28, Mickey D wrote:
"Threat actors could exploit the RockYou2024 password compilation to
conduct brute-force attacks and gain unauthorized access to various
online
accounts used by individuals who employ passwords included in the
dataset,"
the team explained.
Why Passkeys should be used wherever financial transactions or sensitive information are concerned. Or at least TFA.
And passwords need to be strong - computer generated is always best.
Otherwise password access should have time outs.
1st time wrong: no delay
2nd time wrong: 1 s delay
3rt time wrong: 2 s delay
4th time wrong: 4 s
5 8 s
10 4 hour delay, then reset to 0 delay.
Brute force login attacks would simply not work.
A better solution would be to use a hashing algorithm like Argon2 that
is designed to be resistant to such attacks.
Can someone who knows let me know WHAT was published online?
Is it people's login and passwords?
Or just a long list of people's passwords?
If it's just a long list of passwords, what good is that?
A dictionary like lookup would work as well, wouldn't it?
On 07/07/2024 12:26, Alan Browne wrote:
On 2024-07-06 19:28, Mickey D wrote:
"Threat actors could exploit the RockYou2024 password compilation to
conduct brute-force attacks and gain unauthorized access to various
online
accounts used by individuals who employ passwords included in the
dataset,"
the team explained.
Why Passkeys should be used wherever financial transactions or
sensitive information are concerned. Or at least TFA.
And passwords need to be strong - computer generated is always best.
Otherwise password access should have time outs.
1st time wrong: no delay
2nd time wrong: 1 s delay
3rt time wrong: 2 s delay
4th time wrong: 4 s
5 8 s
10 4 hour delay, then reset to 0 delay.
Brute force login attacks would simply not work.
A better solution would be to use a hashing algorithm like Argon2 that
is designed to be resistant to such attacks. That way, if you get
offline access to a database somehow - which is how these passwords were derived - cracking takes a stupid amount of time.
Such modern algorithms use things like salting by default as well, which eliminates rainbow table attacks (pre-computed lists of hashes and their passwords), meaning you need to perform the slow and expensive
brute-force method.
Also, a timeout would only help with online logins. Offline ones are the
real deal, because you can go ham with no consequence.
That said, your idea of using computer-generated passwords is great. I
use 64-character random passwords generated by KeePassXC. It works
great, except for the websites that want shorter passwords, for some
bizarre reason.
Alan Browne <bitbucket@blackhole.com> wrote:
On 2024-07-06 19:28, Mickey D wrote:
"Threat actors could exploit the RockYou2024 password compilation to
conduct brute-force attacks and gain unauthorized access to various online >>> accounts used by individuals who employ passwords included in the dataset," >>> the team explained.
Why Passkeys should be used wherever financial transactions or sensitive
information are concerned. Or at least TFA.
Or, crazy idea, tighten up personal privacy laws like some ridicule the EU for.
It would certainly crystallise minds if companies risked fines of 10% of global turnover.
it will have 0 effect on people with bad security practices
Alan Browne <bitbucket@blackhole.com> wrote:
On 2024-07-07 17:39, Chris wrote:
Alan Browne <bitbucket@blackhole.com> wrote:
Why Passkeys should be used wherever financial transactions or sensitive >>>> information are concerned. Or at least TFA.
Or, crazy idea, tighten up personal privacy laws like some ridicule the EU <-- [AAA]
for.
It would certainly crystallise minds if companies risked fines of 10% of >>> global turnover.
I don't disagree with what you wish, but it will have 0 effect on people
with bad security practices
I disagree. It will help proactively protect them from themselves. Unlike
the current system in the US where the only response is reactively via law suits years after people's lives have been affected.
and 0 effect on criminals attempting to
break into systems.
Again, disagree. If an org is forced to comply with stricter regulations regarding data security then that will automatically reduce the target surface.
However, criminals can be very smart and will change tactics.
The internet grew up from nothing to everywhere all at once and the
security implications lagged that by near 20 years.
Which is why we're now seeing more social engineering attacks nowadays that technical attacks. I'm far less worried about malware today than I used to be.
RockYou2024 leak of 10 billion passwords - the biggest password leak ever https://cybernews.com/security/rockyou2024-largest-password-compilation-leak/ https://mashable.com/article/rockyou2024-leaked-password-database
Alan Browne <bitbucket@blackhole.com> wrote:
On 2024-07-08 03:59, Chris wrote:
Alan Browne <bitbucket@blackhole.com> wrote:
On 2024-07-07 17:39, Chris wrote:
Alan Browne <bitbucket@blackhole.com> wrote:
Why Passkeys should be used wherever financial transactions or sensitive >>>>>> information are concerned. Or at least TFA.
Or, crazy idea, tighten up personal privacy laws like some ridicule the EU <-- [AAA]
for. ------ [BBB] --------
It would certainly crystallise minds if companies risked fines of 10% of >>>>> global turnover.
I don't disagree with what you wish, but it will have 0 effect on people >>>> with bad security practices
I disagree. It will help proactively protect them from themselves. Unlike >>> the current system in the US where the only response is reactively via law >>> suits years after people's lives have been affected.
You're talking about "personal privacy laws" which is not directly
related to computer security.
We're talking about data protection - I miswrote when I said personal
privacy - laws. Which for personal digital data requires appropriate
computer security on the side of the data organisation.
One is policy implementation the other is
security implementation.
They're part of the same process.
and 0 effect on criminals attempting to
break into systems.
Again, disagree. If an org is forced to comply with stricter regulations >>> regarding data security then that will automatically reduce the target
surface.
Now you changed gears (was: [AAA] "personal privacy").
I didn't mention AAA. I mentioned EU and by implication, GDPR.
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 440 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 23:00:02 |
| Calls: | 9,150 |
| Calls today: | 1 |
| Files: | 13,433 |
| Messages: | 6,043,048 |