Hacker News new | comments | show | ask | jobs | submit login

I wonder if this is related to the recent Adobe and vBulletin user database breaches. They might be trying those passwords on GH.

Very likely.

We've just added a kill-list of known decrypted passwords and English language words and forced people to reset their passwords who are listed in the adobe breach.

How do you find out that someone's using a known decrypted password on your service?

From here: http://stricture-group.com/files/adobe-top100.txt

We wrote a script that hashed these passwords with the stored salt for each user and compared the result with the stored hashed value. Basically we brute forced everyone's accounts with the dictionary provided. Anyone who was found with an account that was in the dictionary was locked out with forced password change. We changed the password policy before doing this to increase complexity and block dictionary and the decrypted list words. We also force people to change their password every 28 days anyway and keep the last 7 hashed passwords and salts to verify that the user hasn't reused.

We store financial data so it's pretty hardcore auth requirements.

I wonder. I used the same username and password for both Adobe and github. But they were not able to break in.

Of course I changed the password for github now.

I have 14 failed attempts in the last 4 days.

I didn't have an account on either of those websites, but still had 5 failed login attempts.

Guidelines | FAQ | Support | API | Security | Lists | Bookmarklet | DMCA | Apply to YC | Contact