Have You Been Pwned? - Computerphile

[@thehypest]

Another great video from Dr. Mike Pwned

[@otakuribo]

His business cards should read "Call Pound before you get pwned."

[@adrunkzebra6095]

Welp looks like we have your nickname Dr. Pwned

[@MultiformeIngegno]

Stay EZ My Friends can you elaborate?

[@ManuLeach]

@Stay EZ My Friends I think you've misunderstood how it works. You hash the whole password, but only send the first few characters of the hash. Then, any matching hashes are sent to you, for you to compare with the full hash to see if any of them are your password. There are no changes to the input.

[@ManuLeach]

@Stay EZ My Friends that's entirely possible. My understanding is that the avalanche effect means that the hashes of "000" and "001" and "010" will be very different. Just by changing a single bit, you completely change the output. If I'm right about that, I don't see how it has any effect on how this checks passwords.

[@andrewrobertson1473]

I feel like Dr. Pound was not at all surprised by the people who used correcthorsebatterystaple, yet somehow is still disappointed by them.

[@GummieI]

I was actually surprised that it didn't have more results than it did really

[@elemist315]

This ability is one of the racial bonuses for English characters

[@altaccount8749]

"Horsecorrectstaplebattery" is my choice of password

[@Shizzlewish]

Sweet that the hash for "iloveyoukate" starts with BA8E 😍

[@nibblrrr7124]

Nice! Its MD5 only contains "BAAE3B", which clearly demonstrates that MD5 is the inferior algorithm to SHA-1. :^) (Alas, SHA-256 is still better. But in it, I can only find "BFF". So my cryptographic horoscope is telling me Kate and I will be happier as friends? ^^)

[@VADemon]

@@nibblrrr7124 lol cryptograpgic horoscope! hashing numerology!

[@coweatsman]

That guy has since changed his password to "divorcecourt".

[@Xilefian]

"Pwned? If I'm wrong then I'm a noob" - Mike knows what's up.

[@hakology]

'if you think you know everything, you're not trying hard enough' - H.D.Moore .... everyone is a n00b.

[@Einyen]

@@hakology I know just enough to know how much I do not know...

[@darleschickens7106]

Ahhhhh it’s like 2006 all over again

[@Furiends]

1-2-3-4-5? That's amazing I've got the same combination on my luggage!

[@omegahaxors9-11]

Lol spaceballs

[@rjj5574]

Mines samsonite

[@gumunduringigumundsson9344]

Hehehe

[@asgaines]

@@rjj5574 2814 times in list

[@Kotfluegel]

Hilariously, the other password from that same XKCD comic strip "Tr0ub4dor&3" which was used as an anti password cannot be found in that password API.

[@El_Chompo]

what do you mean by anti-password?

[@lucasbune]

@@El_Chompoit was an example of a poorly chosen password

[@KnakuanaRka]

At least they understood that part well.

[@PragmaticAntithesis]

So... It's a strong password?!

[@polgzz]

@@PragmaticAntithesis not anymore

[@blenderpanzi]

I checked, the password "computerphile" occurs one time in the pwned password list! Why? Who? What!

[@HPD1171]

still waiting on numberphile though.

[@ben-q2d]

It's obviously Sean's password for the Computerphile Google account

[@OrangeC7]

And also how is it working like how did only one person think of this

[@Shadow81989]

@@OrangeC7 only one that got leaked - there might be hundreds of others USING that password. ;-)

[@hiqwertyhi]

maybe that person didn't know about the computerphile channel and thought they were being clever inventing a word?

[@redlaserfox3988]

So if I need to sell stolen password data do I go to the Pwn Shop?? I'll see myself out E- auto @Cadde correct

[@KnakuanaRka]

I’ll get me coat.

[@RealCadde]

Pwn is a correct word, pwne is not.

[@redlaserfox3988]

@@RealCadde I know, derrr Noted, amended

[@cybercat1531]

That's already a deep web blackmarket site

[@Shadow81989]

Now that's an interesting way to check passwords without actually sending them. I like it.

[@mirmbloatbust4783]

Still allows for some nasty stuff in two cases: 1. Only one hash which starts off similarly can be found (not likely), 2. The user checks for multiple passwords. 2 is a problem because all of the hashes that the server returns can be traced back to passwords, and those can be traced back to accounts connected to them. So if the user checks multiple passwords that can be traced back to their accounts, the likelihood of identifying the user increases. But yeah, it doesn't leak the passwords that haven't previously been leaked straight away, but still might make guessing them easier. Thanks to potentially identifying the password habits of the person and having the beginning of a hash.

[@CitronLighter]

@@mirmbloatbust4783 I don't think 1 is a problem. If only 1 password is returned, it's still very unlikely it is yours.

[@mirmbloatbust4783]

@@CitronLighter Yup, I agree. 2 is the real problem.

[@watfordjc]

@@mirmbloatbust4783 2 isn't much of a problem in my opinion. The k-anonymity implementation was suggested by CloudFlare due to the bandwidth usage - you literally have everything from password managers to UK government departments all using the same API. Passwords are also not unique - my weakest password is (to paraphrase) randomstring1 and the next number in the iteration has been leaked (as have some in the 80-99 range - birth years) even though I've never used them. CloudFlare have probably seen most of your passwords anyway as they are the biggest CDN, and most partial hash lookups don't end up going to the origin server because of k-anonymity and aggressive caching. That just leaves trust in the frontend of whatever is using the password API v2, and TLS stack/library/protocol. Also, haveibeenpwned doesn't make the data available to link breached accounts with leaked passwords. If you are concerned about the origin server knowing who you are based on password lookups that return positive results, we are talking about a database built from data breaches that contain your e-mail addresses and passwords. If you only have one e-mail address, it'd be a waste of resources for the API to link passwords to it based on password lookups because the service could have used the data already available.

[@ulissemini5492]

​@@mirmbloatbust4783 i don't know much about cryptography but iirc sha1 hashes are "random" so the first part should not allow them to get the first part of the password.

[@SupaKoopaTroopa64]

*unhackable* shows up 602 times.

[@Shadow81989]

ironic :)

[@HaxorBird]

621 times

[@andrewandrei3062]

@@HaxorBird :3

[@1224chrisng]

@@andrewandrei3062 a --man-- anthro of culture I see edit, YT comment formatting is a pain in the back, I swear it was double hyphens a while ago

[@spiderwings1421]

639 now

The first thing I did once I find out about this website was to inspect all js to figure out what heck it was doing with the passwords. Got really impressed! Kudos

[@TheLucky117]

The out-take is great xD

[@pomegranatechannel]

I love this guy. Please do more neural network videos with him.

[@OrganDanai]

There's a problem using the command line as shown in this video: it will appear in your shell history and for a split second also in your list of current processes. The best way is to have to type your password interactively.

[@bbonvallet]

Also careful not to do it in the interactive Python REPL. I noticed Python 2.7 on my system has no history, but Python 3.5 and Python 3.7 both have a history. Read STDIN and type password in via request from STDIN. No shells, no REPLs, no pipes!

[@NightKev]

The only secure chip is one you build yourself.

[@michaelpound9891]

Someone pull requested my github to fix this already! You're absolutely right, it wasn't ideal what I was doing.

[@Clownacy]

Have you ever heard of sarcasm?

[@Elrog3]

@MichaelKingsfordGray What! Use your real name? You would go through all the trouble to make a secure chip for a password and then give your real full name out on the internet? *facepalm*

[@elliotgehin]

8:53 - not all are publicly available, some are from private breaches which have been given to Troy

[@dekeonus]

What exactly is a private breach in this example? Did the perpetrator break some site and then give Troy and ONLY Troy their ill gotten loot? If the site owner gave the list of exposed data to Troy then in all probability that data is in the wild and may be being traded on exclusive forums, but in that instance it is only a delay to wider public dissemination.

[@willemvdk4886]

His explanations are truly great. Such a good teacher.

[@ChromesClips]

Alright fine, guess I'll change my password to iLoveYouMike

[@mikejohnstonbob935]

iLoveYou*Mike

[@brokentombot]

iLoveLamp

[@GrumpyFinch]

@@brokentombot I see what you did there 👨

[@BlueyMcPhluey]

@@mikejohnstonbob935 make sure to put the symbol in the middle of the word, instead of between words!

[@EmmetFord]

That git repository is a treat. The same program implemented in multiple languages: python, go, haskell, julia (I don't even know what that is), bash and perl, the last being my comfort zone. So now I have all these examples with which to compare and contrast. Very nice. I'll skip the java and powershell if that's OK. Happily, all the passwords I tried passed. My trick is I use my social security number as my password for everything. That way, when one of those sites gets hacked, they'll have everything all in one go.

[@TannerHartwig]

correct horse battery staple.... instant facepalm hahahaha.

[@foo0815]

It's amusing that Munroe's counter-example for a bad password (Tr0ub4dor&3) in *not* in the pwned list...

[@Ghorda9]

@@foo0815 xkcd is known for information warfare.

[@nextlifeonearth]

@@foo0815 His reasoning is quite sound though. If you can't remember the password, you might as well not have a password. Try that principle with other words in that database. Tip: use a word that's not in the dictionary (and not in use in general) in the password, that you can actually remember. (ex: "fortify persident campaign etchings"). And put your choice of easily remembered special characters in there.

[@nextlifeonearth]

@@Reelix That's why you should just include one word that's not in the dictionary.

[@asdfghyter]

Xileer Torias No, the point of the approach is that you calculate the entropy given that it is in a dictionary. Of course, partially deviating from the pattern by adding a non-word or special characters in the middle will still make it even stronger.

[@_ck_]

regarding bad practices people do with well intended info from these videos, I know its just a demonstration but I'd still like to point this out. if you were to use some small commandline utility you threw together yourself to check your passwords, like in the video. they'll end up in your shell history(every command you ran goes there for a while) which is just a plaintext file. Effectively undoing the whole point of an encrypted password database. cheers

[@gyroninjamodder]

CK You can put a space before the command and it won't store it in the history

[@teh_jibbler]

export HISTIGNORE='[ \t]*' Then put a space in front of any command you don't want in history.

[@teh_jibbler]

Probably doesn't save you from audit log, though. Don't let people read audit log.

[@hrnekbezucha]

@@gyroninjamodder TIL. Thanks!

[@michaelpound9891]

Thanks for pointing this out - I did eventually upload my code to github and someone already put in a pull request fixing this :)

[@isaacpearson1634]

"password" has been leaked 3,645,804 times.

[@marekmichalovic8711]

I will not fall for the same mistake as others have! I will use "wordpass"! No one can ever guess!

[@marc-alexandrelaroche6632]

@@marekmichalovic8711 , we need more smart people like you.

[@FirstDagger]

How often has "has been leaked 3,645,804 times." been leaked?

[@marekmichalovic8711]

@@FirstDagger That might have been a decent password until you wrote it

[@Jouzou87]

And "123456" like 23 million. Taking a positive angle, if there are 3 billion people on the internet, that's only the dumbest 0.5% (taking into account duplicates and troll accounts).

[@a3f4cdf]

I've been pwned endless times lol This is also a good way of finding out where other people have been signing up 😉

[@sypherverendz7663]

Is this safe?

[@charlesgerard5721]

Great video. Not nearly as dense and dull as lectures, still informative, and actually entertaining and easy to watch.

[@messengerofiexist2139]

Yes. I was pwned the moment I purchased my hardware, with all of its built in backdoors and in designed vulnerabilities. Cell phones have 200 builtin backdoors for “network monitoring” in order to prevent violations of “insert country regulatory body here” frequency regulations. Anyone who buys any technology is owned at the time of purchase.

[@Yotanido]

Found this API about two months ago and immediately implement a script that goes through every password in my password manager and checks it. Super handy tool, gotta give it to them. (All my passwords turned out not to be in there, but you never know. Though, if a password does get compromised, it's not a big deal for me, anyway, since I don't reuse passwords)

[@xwolpertinger]

If you are very paranoid you can always just download the pwned passwords list and write some code to do it all locally. On the plus side, you'll learn how to search through a 22+ GB file quickly!

[@dustysparks]

Multi-threading!

[@mirmbloatbust4783]

Was fun to work with the 1TB leak few months ago to create an alphabetically ordered password list of all the unique passwords, followed up with the number they were encountered in it. Would have been swell to do that on a SSD and more memory than 4GBs in hindsight. :P

[@mirmbloatbust4783]

@@dustysparks No need to multithread, just have the file organised alphanumerically and do a binary search.

[@zvpunry1971]

If the file is already sorted, then it will be extremely easy and fast to search it, even on a slow system with slow I/O. No need for multi-threading or anything special. seek into the middle of the file, read until a newline is found, see if the hash is less, equal or greater than the searched one... depending on that check you search the part before or behind the current position. Its just a binary search. This could be done by hand. If the file isn't already sorted, then fast hardware (a computer) could be useful. If only one hash is searched, just use "grep completehash pw-hash-list.txt", grep uses a quite fast algorithm (boyer moore) to find a word in a large amount of data. If the file isn't sorted and many hashes should be checked you need a lot of ram and a program called "sort", just sort the list and use the second mentioned method. ;)

[@xwolpertinger]

There is a version sorted by hash which is of course rather fast to search through (and more easily compressed to boot)

[@BlochStier]

A ressource of the code used in various videos would be nice :)

[@hurktang]

1) Hash in sha-1. 2) Request the appropriate address. 3) Cross the list to search for a match. 4) Output the result. You should not trust anyone and do it yourself. Time to learn how to code ?

[@casperes0912]

hurktang if you can audit the code there’s nothing wrong with using someone else’s

[@alpha_ceph]

I've also written my own version. It supports checking multiple passwords with a file: github/lukas-dachtler/pwned.py

[@chrislynch8]

If you give me a list of all your passwords I'll check for you. 😎😎

[@BlochStier]

@@hurktang "various videos", not necessarily this one. This one is fairly easy to replicate :)

[@relativityboy]

So much value in less than 11 minutes, and 100% accessible to anyone who knows python isn't just for snakes.

[@vedi0boy]

I like how he laughs for like a fraction of a second then starts talking seriously. It’s very funny lol

[@Phroggster]

Now, if only we could convince websites to refuse new passwords / password change requests that appear on these lists. Then, after that, we might be able to convince websites to use bcrypt, and increase their maximum password length such that correcthorsebatterystaple could actually be used if it wasn't already disclosed and prevented by step one.

[@Baxtexx]

Yeah that would be great. However website owners wants as many users as possible. If the user find it cumbersome to sign up, the website might loose that user and potentional revenue. We would practically have to make it punishable by law to use crappy passwords.

[@RealCadde]

@@Baxtexx Carrying the death penalty for that particular genepool.

[@plasticuproject]

Troy Hunt's API is absolutely awesome. He also gives love to all the developers who use it to build applications by posting links on the website.

[@Thumli]

One thing to keep in mind with using that python script is that you are probably storing the password as clear text in your command history.

[@iwikal]

Add a space before the command to omit it from bash history, or better yet, use the getpass python library.

[@juliusbecker8451]

From time to time i come back to this video for some entertainment

[@martink4964]

Thumbs up, if you're a developer who salts passwords. This makes one of several examples for why salting is important :)

[@zvpunry1971]

I'm sure there are people who use salted plaintext passwords... Always assume the worst, don't trust anyone. ;)

[@joonasfi]

That's also outdated. Salting is not enough in the slightest. Use bcrypt or pbkdf2. See Tom Scott's video about password storage.

[@jeremyelliot4831]

@@joonasfi Are you saying bcrypt(password) is just as strong as a bcrypt(password + salt) ?

[@recklessroges]

salting? (What is this? Security for ants?) argon2 then scrypt then blowfish then bcrypt. (I doubt all four have been compromised at this stage.)

[@jeremyelliot4831]

@@recklessroges "In cryptography, a salt is random data that is used as an additional input to a one-way function that "hashes" data, a password or passphrase."

[@jonnyclueless]

Thank you for this video. I have now changed my password from iloveyoukate to iloveyoujan. Now I can rest easy.

[@vfrunza]

My passwords from when I was a kid have surprisingly never been cracked. I'm shocked.

[@TheComedicPCGamer]

no one wants to hack your roblox account dude

[@Nitrxgen]

never been leaked or never been cracked? there's a difference

[@M4rc05P]

There is a chance that someone have your pass but didn't make the database with it public nor shared with Troy Hunt (haveibeenpwned guy)

[@doms6741]

What was it?

[@milesofmemes7750]

mine have

[@_Pyroon_]

urmom : 6367 times urmom1 :12626 This was true for many passwords. It seems adding a 1 at the end of a password might actually make it less secure.

[@sieevansetiawan4792]

"urmom" is only 5 characters. I guess most people would use at least 6 characters.

[@nearlyepic4831]

@@sieevansetiawan4792 More sites are expecting a number and capital letter as well. Easiest way to do that is to add a 1 at the end.

[@spencert94]

It’s also fun to go onto the password site to find all the horrible phrases people have as passwords that have been pwned

[@cwmcelfresh]

One "strong password" (459 matches for strongpassword) technique folks use is to choose the first char of a series of words from a song. The results for "Jumpin' Jack Flash it's a gas gas gas (jjfiaggg)": 56 matches. For the typing class phrase "The quick brown fox jumps over the lazy dog (tqbfjotld)": 956 matches. (Yes, I know computerphile (1 match) recommended adding special characters to such a PW, so, "jjfiaggg!": 1 match :) ). Golly (541 matches) it's fun to guess the cleverest (90 matches) passwords, like "iamclever": (164 matches) but "youareanidiot" (57 matches) and hit this range API with my little golang (24 matches) script. And thanks for introducing me to k-Anonymity (0 matches!!), neat!!

[@ribbonsofnight]

jjfiaggg is a bit too brute forceable. might as well go for longer songs ittrlitjfcialnefr or talwsatgigasbasth There would be people who could figure these out from that alone but for everyone else They are very long popular songs by Queen and Led Zep

[@marc-alexandrelaroche6632]

He uploaded this the day my account got compromised.

[@vvvvvv66666]

Oof

[@Gamesaucer]

Oh, that's a really elegant solution! I like it.

[@oafkad]

Those buttons are amazing. I spent far too much of this video looking at those buttons.

[@sieevansetiawan4792]

"correct horse battery staple" was compromised? Time to change to "incorrect horse battery staple".

[@mu11668B]

Too bad it's already pwned too. :/

[@rafaeldeconde8148]

I love all Videos Mike makes to computerphile, I wish I could meet him!

[@BlitzPSH]

I actually knew about this! Huge fan of this approach. Have gushed about it to some coworkers.

[@TheSpacecraftX]

Mike's videos are the best ones.

[@dragonmateX]

I know computerphile is hosted by a different person, but it feels strange to not hear Brady's voice behind the camera

[@DanCojocaru2000]

This guy is awesome. I knew all this stuff already yet I still was entertained!

[@theepicslayer7sss101]

well it is nice to know a bit more about the "Have I been Pwned" site... even if i hear it is safe i would rather have multiple sources of trust to confirm... even tho you are the second! (the other was a PC security channel that tests antivirus programs)

[@err2260]

Which thinkpad model is that?

[@CeilingPanda]

Thanks for posting this, now I can link this video to people who think I'm trying to hack them, when I link HaveIBeenPwned

[@simonalexander7137]

I like that you make your notes on tractor feed paper

[@Xevailo]

What's your stance on password managers in the cloud such as the mentioned one password or dash lane for example? So many people seem to be using one of these kind these days, but I'm still very sceptical.

[@tynandouglas348]

I think the reputable ones encrypt/decrypt client-side using a master password. If they also use your master password to login, I believe what gets sent to the server is derived from a hash of the password, not the password itself. Though this does mean you should be extra careful choosing your master password.

[@recklessroges]

Xevailo at least use keepass or better while you do your own due diligence.

[@callumstewart5891]

Surely using this API to check a password before you use it is a bad idea? If you input a password, and it's not found, you would think it's safe to use. But you've just given it to the API, so now it will be in there, and that means it's not secure anymore.

[@yommish]

You’re just sending the first few characters of the hash. The server doesn’t know your password or whether it is in the list or not.

[@billoddy5637]

Mike, talk to us about AES. I know that deep down, you have an urge to do so!

[@Kurtownia]

I'd love to tell you just how great my password is, but then I'd have to change it, so just believe me.

[@recklessroges]

I've already seen it. You should change it as you've been using it for far too long.

[@holcus1]

so how do you work out diacritical marks / accents? I am cheking Polish for password (hasło) and I get 0 matches even if I enter it on /password site directly.

[@daihop]

I enjoyed the Hackers reference at the end

[@lobrundell4264]

Of course Mike's code is in the doobly too. Legend

[@bailey125]

How do you install requests? The pip command returns "'pip' is not recognized as an internal or external command, operable program or batch file."

[@jameyd916]

Make sure you install pip with the option ticked to add it to your PATH variable.

[@bailey125]

@@jameyd916 I'm sorry, but that makes no sense. There are no options or check boxes in command line.

[@jameyd916]

@@bailey125 when you install pip with the python windows installer it was checkboxes, I meant those.

[@bailey125]

@@jameyd916 Oh... I installed python years ago lol. Maybe I unchecked it when installing. I'll probably just reinstall. Thanks :)

[@bailey125]

@@jameyd916 Managed to fix the issue. Turned out that I did have pip installed on python 2.7, but I also had python 3.3 installed which does not come with pip and command line was using python 3.3, so I uninstalled 2.7 and 3.3 and installed 3.7 with pip and it all worked fine.

[@75hilmar]

Hi. Love your content. This question might seem a bit off topic, but since you like to look at things from a different perspective, I think you might have an interesting opinion on this: I have been looking into amateur music production lately and I found out that sound cards in laptop is just not a thing. Which really surprised me. But I got to think that with the help of graphic cards you should be able to model oscillators properly and therefore I figured there should be a way to use one's graphics card capacity for sound rendering?

[@Lam-s-Workshop]

Yet another great, clear and concise video. Thanks

[@ZomB1986]

Bitwarden password manager also has a password leakage detection built in.

[@Lazy_Llama]

I love this channel especially the vids that involve security

[@SEThatered]

I know several languages, so in order to create a password I just think of some sentence that has my personal, unique association with the service, then translate it through several languages and at the end I translate it into an agglutinative language where it is a convenient long word. Even if I tell you the word out loud it would sound like a bunch of gibberish, but it makes perfect sense to me and is connected to a specific software/service in my head. So far I haven't forgotten any of my passwords.

[@broup9137]

Eugen Afanasjev wow your so smart you probably have a huge weiner

[@benjaminbrady2385]

I have been leaked 10 times with 0 pastes and had used the same password everywhere from the early 2000s up until 2016 :O

[@dustysparks]

Duuuuude

[@joonasfi]

What are you waiting for? Go grab a password manager and change all your site passwords!

[@Furiends]

Not bad actually.

[@Furiends]

I know it seems radical but its about time we just get rid of passwords. Any time you type in a password its a liability that it will be recorded or compromised. Using your phone as authenticator is great. If your phone gets stolen you just have to remove it as an authenticatior. If you want to have some time so the thief can't immediately get into your accounts add a phone lock with pin or fingerprint. While these methods are not super hard to crack it'd still take hours to days. Phones can also be remote locked and easily deactivated. The only problem is there's no universal or standardized way to authenticating this way.

[@superfluidity]

How do you authenticate yourself to the system that lets you remove your phone as an authenticater? I agree that there are lots of problems with passwords, but it's very hard to find something that can fully replace them. People have been trying for decades.

[@Furiends]

@@superfluidity There's no way to revoke who has access to your password except to change it. When you make an account it authenticates to that device like your desktop from there you can tell a website to authenticate with your phone. As a backup you can use a public key stored on your desktop or on a usb key to do management like locking all authenticators.

[@Ruxinator]

Extremely useful information! Thanks for making this video

[@nilaksh007]

I ran the script today and password1 was found 2413945 times! And password1234 was found 23183 times Iloveyoukate was found 95 times Correct horse battery staple was found 120 times @computerphile , does your video has negative effect?

[@sirelkir]

If you're using that python command on a Bash terminal make sure you add a space before the command. This way (on most versions by default) it is not stored in the bash history for someone to accidentally stumble upon all of your passwords.

[@dekeonus]

that just stops it appearing in your shell history, does not stop the password appearing in the process list or audit logs (on systems doing auditing)

[@palqaz3024]

dsenti may just be on to something. If you take the SHA-1 hash of Dr. Mike's example - be it password1, or Password1, or password 1, or Password 1, the hash doesn't start with FA2241C. And if you use cURL to input any of those actual hashes into the website, it doesn't return ANY corresponding leaked hashes! Of course, the hash depends on SO much more than just what the password is - like the font you use, whether it is ASCII or UTF-8 encoding, whether you create the password in Notepad vs. Wordpad vs. RTF vs. MSWord, etc. and probably a hundred other things. Which renders the whole exercise of hashing your password yourself for submission rather pointless. Or worse, it lends a false sense of security when no hits are returned. So you're really only left with the option of typing your password into a random box on the internet. I think I'll give it a try it right now - NOT!

[@deckluck372]

Hilarious closing - "I thought you were leaked. (embarrassing look). Definitely not. " You guys provide informative and useful content. You should be a the ten million subscriber mark. Keep on keeping on!

[@benhetland576]

And the hash for 'iloveyoukate' starts with BABE... Of course it does! LOL

[@IceMetalPunk]

Well, BA8E, but close enough!

[@Shadow81989]

Wow, nice! That almost seems like somebody generated the hashes for all "iloveyou[female name]" that he could imagine, and checked them before choosing "kate", lol

[@OrangeC7]

Problem with correcthorsebatt*erystaple though is that people can modify a dictionary attack by trying to insert characters like that. It's not likely, but it's still possible, so best practice would probably be if the original four-word password is in the database, try using something different first anyways.

[@JochemKuijpers]

simpele word concatenations aren't considered that safe anymore. Not at length

[@ribbonsofnight]

The person who talks in this video has another video on this channel that discusses exactly that

[@ribbonsofnight]

@@JochemKuijpers if they're all words like simpele it's still probably a very viable password strategy.

[@M3n747]

I was in the process of checking "correct horse battery staple" when he said to try "correct horse battery staple". :D

[@xJackkHD]

Decided to go to haveibeenpwned and search my main 2 emails, and I’ve been Pwned on both. Guess I’m creating a new identity and moving to the other end of the earth.

[@Cygnus0lor]

Bloody beautifully explained

[@davidk3177]

Thank you for making useful vids. I will be using your code at home and work right away. I also love that you use python. I have learned much from reviewing code that you've offered. Cheers!

[@daveslow84]

it blew my mind that correcthorsebatterystable is now a used (and leaked obv) password :D

[@daveslow84]

staple! :D

[@kempyboi123]

Glad you guys mentioned this site, it's rad 😊

[@guyguy7714]

10:01 i love the pure disappointment in his voice

[@veggiet2009]

But what's in between n00b and l33t?

[@recklessroges]

m16.5k

[@superfluidity]

It's not great to type a password in the command prompt like Dr Pound did - he passed the password to his python program as a command line argument when he ran it. That means it will be in his command line history etc. It's better to design the program so that it asks you to type in the password after you start it.

[@leftaroundabout]

Right. If you have such a program, you should call it with `xargs python pwned.py` (which will wait for the password on stdin, before running the actual script).

[@lunasophia9002]

leftaroundabout This is still a problem because the arguments to xargs will show up in the process list and also show up in the commandline history, so you've just moved the problem about instead of actually addressing it.

[@IceMetalPunk]

Or, you know, just... clear your history after use :D

[@leftaroundabout]

@Chris they do show up in the process list, true. They do _not_ show up in the shell history. Or what do you mean?

[@nevemsenki5592]

Fun fact: his e-mail address from Nottingham University (which can be found easily by searching on internet) is also on the pwned list. :)

[@bp7901]

Every video this guy makes, a password dies.

[@SuperAWaC]

lastpass is really lagging behind not implementing this

[@d1663m]

I've always heard it said as just normal "owned". Not sure if it's the first source but look up the Pure Pwnage videos here on the Tubes. They say it as normal "Pure Ownage" and not "pone-age".

[@AnimilesYT]

I've always heard it said as powned. But it could be because I'm Dutch and most people read it before they heard it.

[@bnctaj]

@@AnimilesYT it's not just because you're Dutch.

[@DanielJohnNicholson]

I've only ever heard it as "poned".

[@stoneskull]

i accidentally pressed p instead of o when typing in counterstrike. it was meant to be 'owned' but it can be pronounced both ways

[@kovanovsky2233]

Someone actually used my real name as a password, it got 4 occurrences. wtf lol Mind you that my name is so rare that if you google it, you'd find me and only me.

[@anteconfig5391]

It was probably one of your relatives or someone who likes/loves you.

[@MrTorsvik]

When I was in high school I cracked the admin password for our IT guy. it was kari3sko.... I wasn't allowed to use the computer anymore

[@666Tomato666]

gotta love our education system: take the kids that are more interested in a given topic and then punish them for expanding their knowledge

[@kanekeylewer5704]

​@@666Tomato666 Well, no. It's because what he did was illegal and abusive to the system. Dumbass.

[@666Tomato666]

@@kanekeylewer5704 a password that can be cracked is a horrible password, not bad, horrible and using horrible passwords is like putting a post-it note on the door asking not to enter, of course a kid will want to take a look

[@kanekeylewer5704]

@@666Tomato666 Any password can be cracked, dumbass.

[@samandrew8158]

​@@kanekeylewer5704, shut up, you petulant little child.

[@TrimutiusToo]

Some people are actually using password from xkcd? *facepalm*

[@asgaines]

What's even better is that xkcd appears as a password 49 times

[@TrimutiusToo]

@@asgaines the funniest part is that Tr0b4dor&3 actually doesn't appear at all... From the same xkcd comic...

[@squirlmy]

How many times does FACEPALM show up?

[@KnakuanaRka]

Timur Sultanov At least everyone got that correct.

[@nicktheoregonian]

Great Hackers reference!

[@roflbofl]

I always wonder, is there anyone on the background you're talking to ?

[@blucat4]

No, you're hearing voices. :-)

[@MuhammadAhsanKaleem]

Nice video as always. Why were you using duckduckgo though?

[@astropgn]

Is there a repository where he uploads the code so we can take a look at them?

[@GadgetCentral]

Why does this filming style remind me of The Office?

[@luansalja60]

great video again !!! can you make another to explain the spoofing; like when we receive mail from your own adress...

[@PasaiShere]

i get a name error : "module not found error" is not defined. what can i do about this, sorry i'm a noob at this

[@CottidaeSEA]

For two of my passwords, I took four random words out of a dictionary, pulled 4 to 6 letters out of each, scrambled upper case and lower case, then added random numbers at random intervals. Pretty sure it doesn't get much safer than that without simply making a longer password.

[@esquilax5563]

At that point, you may as well just skip using the dictionary, and just generate a random string of characters. It won't be any less memorable

[@CottidaeSEA]

@@esquilax5563 Not really, since I can easily remember the words I picked.

[@GainingDespair]

As a teen growing up in the early 2000's I refused to use words in my passwords it was always 1 capital letter followed by a string of numbers and a symbol. I felt it was a great idea and no one could every guess a password as random as that while trying to sign into an account with my email. As I got older I learned that wasn't a great idea to begin with and I'm not creating a password to fool people but computers. Computers do not care if my password if 100 characters or 100 digits at the end of the day it will test everything and people are smart they realized a lot of passwords have similarities like a capital letter first, and numbers at the end/symbol and you can alter dictionary to counter act this which made my password scheme pointless. Now knowing how hashes are I just add a new character or symbol each year and hope best case the servers of the sites I use do not store passwords in plain text and salt their hashes with something like the day of the month I joined and time. Enough to keep it simple but enough to make each hash different, salt that is the same for every hash servers no purpose. Now my main password is 20 characters/digits long with multiple caps, and symbols on top of that I use the sites name in each pass like YT for KZbin to add a little bit more of a variable to the hash and not use the same exact password for everything. Looking at the hash they can't tell if my password is pass1 or sdfgonigasdfiojserjipw34r-u924t08iar-t0 8ywq4-82y345w4y5- 048404958-w 084 t shfgj nsdgb fgkab as you just 1 character/digit/symbol difference will dramatically effect the hash. Length is your friend it gets to the point where just 1 more character can make your password 10 times harder to dehash and that's really your only defense... You can't beat the computer... you can't but you can annoy the person trying to dehash the database enough for them to simply discard your hash as it's not worth their time trying to dehash 1 password if it takes their computer 2 straight months to do.

[@AbhimanyuSirothia]

Is it possible the API returns only the remaining of the hash to ensure that even if that list was somehow intercepted it is of no use without the prefix that was sent over https?