PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Passbolt: a bold use of HaveIBeenPwned

blog.quarkslab.com | incident | #privacy | #password-cracking | #k-anonymity | #password-manager | #passbolt | #haveibeenpwned
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab shows Passbolt's use of the Pwned Passwords API leaked the passwords it checked: an observer of API queries could recover an 11+ character password via incremental search; fixed in v4.6.2.
Published
Collected

Related coverage

incident · projectblack.io
Dumpster Diving for Data
A discarded physio clinic PC with no disk encryption yielded thousands of medical records: the author cracked password hashes and recovered Medicare numbers, DOBs, and treatment plans from 2013-2018.
incident · hackenproof.com
LinkedIn Data Breach: 66 Million Scraped Records Exposed in an Unsecured Database
An open MongoDB database exposed 66 million scraped LinkedIn profiles—what was taken, whether scraping like this is legal, and how it compares to LinkedIn's larger 2021 incident.
research · blog.quarkslab.com
Post-Exploitation: Abusing the KeePass Plugin Cache
A post-exploitation technique that injects code into KeePass without process injection, by abusing the cache produced when PLGX plugins are compiled.
research · blog.quarkslab.com
Have you ever played with Domino?
Reverse-engineering IBM Lotus Domino password storage: the user.id file's ciphered 5-byte digest, built from RC2 and SHA-1 through a custom scheme, and a John the Ripper plugin to brute-force it.
blog · bughunters.google.com
The Great Google Password Heist: 15 years of hacking passwords to test our security (and build team culture!)
Google's security team describes its 'Leaving Tradition,' a long-running offensive security exercise where departing members hack passwords to test defenses and strengthen team culture.
blog · blog.trailofbits.com
How Trail of Bits helps verify the integrity of your Signal chats
Trail of Bits explains Signal's Automatic Key Verification key-transparency system and describes the independent auditor it operates, one of three signers that make server key substitution detectable.
Back