It is not at all unusual to say that memorizing passwords is a drag. They are hard to remember and we all have a few to improve the security of our accounts. Having a single password for everything we already know is not a good idea.
But what happens when massive data breaches occur to the large companies we entrust our credentials to on the network? In the face of a collective and intensive hacking, our usernames and passwords can be totally exposed, but fortunately there is an easy way to find out if our credentials have been compromised.
The Have I Been Pwned (HIBP) website, developed by Australian security researcher Troy Hunt, allows us to check if our email addresses and user names have been involved in any of the many data breaches we have experienced lately (Adobe , Dropbox …).
In the same way, Hunt created another tool to approach this problem from the opposite perspective: from that of passwords. The new tool, called Pwned Passwords, does the same but with the difference that when entering our passwords, it exposes us if they are secure or have been exposed in some type of hacking action.
There are more than 320 million passwords stored in this database (previously leaked or victims of a massive hack). But, is it safe to group all the passwords on a website like this?
We can rest easy, because none of the passwords is stored together with their respective email or username , only vulnerable passwords are exposed, so there is no danger that this website will make the work easier for hackers. In addition, the success of Pwned Passwords is to draw attention to the problem of how many of our passwords have been identified so far.
So, if when checking your password with the application, you see that everything turns red, take advantage and renew your range of passwords. You will not regret. Of course, Hunt clarifies that the safest method of checking the reliability of a password is to download the entire list of leaked passwords, stored in three separate text files (more than 5 GB in total) and review it. It’s a tedious thing, but it’s worth it.
For added security and to protect everyone still using these leaked passwords, the passwords for the listed files have been encrypted with SHA-1 hashes, so you’ll need to hash your password before searching the list for it.
If any of your passwords have been compromised, you may also want to consider using a password manager to store and generate them.
“A quick word of warning about the search feature: absence of evidence is not evidence of absence, or in other words, just because a password doesn’t hit back doesn’t mean it hasn’t been previously exposed,” says Hunt. This means that if when looking for our password we discover that it has not been violated, it does not necessarily mean that this password has not been leaked at some point, only that it is not included as part of this database developed by Hunt.
Webs útiles: Have I Been Pwned y Pwned Passwords
