A new Google tool tells you if your password is unsafe
During its incessant web crawling, Google's search engine constantly encounters credentials dumped by hackers or left exposed by the careless. And because it can, the ad confectionery copies and encrypts these spilled usernames and passwords.
Armed with this info, the Chocolate Factory directed its software engineers, in conjunction with crypto boffins from Stanford University, to create a Chrome browser extension called Password Checkup that allows Chrome users to check to see whether their passwords can be found online.
The hope is that users thus warned will get the hint and change the compromised secret.
Mozilla's rival browser Firefox implemented a similar service last year called Firefox Monitor that checks a third-party database of exposed credentials called HaveIBeenPwned.com. Users of password management app 1Password also have access to an extension that checks stored credentials against exposed ones using the same service.
Google's Password Checkup extension takes a similar approach with its internal dataset of 4bn identifiers.
Your password is safe - trust us
Members of Google's security and anti-abuse research team – Jennifer Pullman, Kurt Thomas, and Elie Bursztein – claim that "Google never learns your username or password" even though it collects the data.
"At a high level, Password Checkup needs to query Google about the breach status of a username and password without revealing the information queried," the trio explain in a blog post today. "At the same time, we need to ensure that no information about other unsafe usernames or passwords leaks in the process, and that brute force guessing is not an option."
The company's supposed ignorance of these secrets arises from repeated hashing and privacy techniques like single-party private information retrieval (PIR) and 1-out-of-N oblivious transfer.
Google hashes found usernames and passwords with the Argon2 hash, storing first two bytes of the hash an index for lookups, and then encoding the hash with elliptic curve encryption.
Password Checkup can thus subject user credentials to the same encoding process and then query Google's database of unsafe passwords for match candidates using the two-byte index. Google returns the set of encrypted hashes that share that anonymous prefix to be compared on the user's local machine to the encrypted hash of the user's current username and password. A match means it's time to come up with a new password.
Pullman, Thomas and Bursztein say that this is the first version of Password Checkup and that they expect to refine it over time. They may have to if the Chromium team's proposed Manifest v3 changes to the Chrome Extensions platform go ahead: the extension relies on the webRequest API that slated for future renovation.
In terms of privacy permissions, the extension can read and change site data on all websites. If that's a concern, consider DuckDuckGo and the Tor Browser.
In a Twitter chat with The Register, Troy Hunt, the security researcher who created HaveIBeenPwned (HIBP), expressed support for Google’s similar service.
“I think anything that drives people away from the behavior that is password reuse is a very positive thing and on that front, I’m glad they’ve done it,” he said.
“It certainly doesn’t bother me that they’re doing a similar thing to HIBP’s Pwned Passwords, it’s a completely free service with the same objectives they have anyway.”
He said he wasn’t familiar enough with the workings of Google’s system to evaluate its privacy implications. “I believe it’s similar to the model Cloudflare came up with for HIBP which is really solid privacy wise,” he said.
“Of course, being Google people will always assume they’re trying to siphon up all the data, hopefully that’s not something that’s actually happening in any fashion that would impact privacy.”
Industry: Cyber Security News
- Contract SailPoint Programme Manager - UK 12 month+ project
- United Kingdom
Programme manager with SailPoint IdentityIQ IAM experience is needed for a 12 month rolling contract. To engage and manage a enterprise client programme of work focused around SailPoint. This is a hybrid role, some limited travel to London / Reading maybe required. You must have enterprise level programme management, a focused and recent history within Identity and Sailpoint project experience. Exclusive project, interview immediately.
- Outside IR 35 contract- Threat & vulnerability analyst - SC CLEARED UK REMOTE
6 month rolling contract Outside IR35- immediate start. Threat and Vulnerability Analyst. Tenable.sc experience needed. The ability to deploy agent, configure environments, run active and passive scans, produce reports and prioritise remediation activities based on output Current and ACTIVE clearance is required
- Chief Information Security Officer- CISO. London
Chief Information Security Officer (CISO) is needed to join a senior leadership team that is driving change across a London based FTSE business. You will have responsibility and accountability to define and execute an information & Cyber Security strategy. To be successful you should have the following experience; Experience defining, presenting and executing against your information AND cyber security strategy. Experience delivering / managing functions across information security GRC / Audit and technical Cyber Security capabilities. Senior stakeholder management to the executive committee. Embedding Info / cyber security within a Cloud focused environment. Further develop, expand and mature the information / cyber security function | team. Be able to regularly commute to London Financial services experience is desirable. If this sounds like an opportunity you are interested in then please use the below form to schedule a call. This is an exclusive project to DCL Search. All conversations are kept in confidence.
- IAM Business Analyst- ForgeRock
- European Union
- £500 per day
IAM Business Analyst with ForgeRock experience is need for a 12 months contract The client is in the middle of a large scale ForgeRock deployment and the BA will sit between the technical teams and the business helping to ensure the project is a success You will need to be a strong business communicator and have experience of mapping business needs against ForgeRock features This will be a remote project dealing with teams in different geographies, you must have strong English communications skills and be happy working remotely and able to be proactive to ensure your side of the project is a success