Tell HN: GitHub will reset passwords June 24, 2020

5 pointszatel6y ago6 comments

When I logged into an old github account I recieved this message:

The password you provided is weak and can be easily guessed. To increase your security, you must update your password. After June 24, 2020 we will automatically reset your password.

-----

It's only for insecure passwords I guess but hopefully if someone needs to see this they will

Tell HN: GitHub will reset passwords June 24, 2020

5 pointszatel6y ago6 comments

When I logged into an old github account I recieved this message:

The password you provided is weak and can be easily guessed. To increase your security, you must update your password. After June 24, 2020 we will automatically reset your password.

-----

It's only for insecure passwords I guess but hopefully if someone needs to see this they will

6 comments

6 comments · 2 top-level

pvsukale36y ago· 4 in thread

Just out of curiosity: how do they understand password is weak if it is hashed?

akerl_6y ago

The standard way is, as is pointed out in a parallel comment, checking when the user logs in (since they have to send their unhashed password to the server as part of logging in).

Another approach is to use things like https://haveibeenpwned.com/ to detect users whose credentials are compromised and alert them.

Another more involved approach is to actually try to find collisions with user passwords (using either common wordlists, generated wordlists, or straight brute force) and then notifying users if they find a hit.

mtmail6y ago

OP wrote "When I logged into" so presumably at this point the website can check the password against a password strength/complexity algorithm or top 1000 lists. Ther user had to change the password immediately. Only if you try to skip the step it will auto-reset.

jhayward6y ago

I don't know what method GH is using, but the standard attack on hashed passwords is the use of rainbow tables[1]

[1] https://en.wikipedia.org/wiki/Rainbow_table

gus_massa6y ago

Most modern hash algorithm like bcrypt or scrypt add automatically a salt to prevent the use of rainbow tables.

rpg36y ago

I had the same message last month, except my deadline was April 24th. Anyone that's affected will see a message when they log in, but it will actually only reset until you try to log in after that date.

For me, I logged in a few days after my deadline and instead of showing me the warning it just forced me to reset my password. I'm assuming they're doing it on a rolling basis of some sort.

j / k navigate · click thread line to collapse