"Pwned Passwords" V2 With Half a Billion Passwords
The UX of a blacklist with a half billion entries would be so crippling that it would cause a user revolt.<p>Most people&#x27;s password-selection strategies are similar enough to other people&#x27;s (like kbenson&#x27;s 4000+ hit) that they could spend <i>hours</i> trying to come up with a password that has never been leaked before.<p>I tried to encourage Troy to suggest to implementors that blacklisting all passwords was a Bad Idea. Instead, he doubled down:<p><a href="https:&#x2F;&#x2F;twitter.com&#x2F;TychoTithonus&#x2F;status&#x2F;966400790221930496" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;TychoTithonus&#x2F;status&#x2F;966400790221930496</a><p>Please don&#x27;t use the entire list for blacklisting <i>unless</i> you actively also guide the user in how to generate a random passphrase (if a human must remember it) or a random password (if it will be stored in a password manager).<p>Instead:<p>1. Use a high-level password-strength assessment widget like zxcvbn:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;dropbox&#x2F;zxcvbn" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;dropbox&#x2F;zxcvbn</a><p>2. Configure a blacklist with, say, 10K or 20K of the most common passwords.<p>3. Hash passwords with bcrypt cost 12 (adjusted to your platform&#x27;s hashrate capabilities), scrypt, or the appropriate method from the Argon2 family.<p>But for all that is holy, please don&#x27;t use Troy&#x27;s entire corpus - or even the first million - as a blacklist. To quote the old NANOG saw, I encourage all of my competitors to use it. ;)<p>Edit: And since Troy&#x27;s API at this writing does not support only querying the top X passwords, there&#x27;s no way to use the API while avoiding the UX nightmare. So if you want to use this data in a professional manner, but don&#x27;t want to download the entire corpus, here are the first 20K from his list (of which I&#x27;ve only personally cracked 19965 so far, interestingly; gist will be updated once I get all 20K):<p><a href="https:&#x2F;&#x2F;gist.github.com&#x2F;roycewilliams&#x2F;281ce539915a947a23db17137d91aeb7" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;roycewilliams&#x2F;281ce539915a947a23db17...</a><p>Edit 2: Preliminary results indicate that this data may be dirty. The 273rd most common password, according to Troy, is &#x27;$HEX&#x27;. This is almost certainly an import&#x2F;conversion artifact, since the &#x27;$HEX&#x27; prefix is how most cracking suites escape non-ASCII or passwords that contain colons. I expect that there will be more artifacts. Use the data with caution.