<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div dir="ltr"><meta http-equiv="content-type" content="text/html; charset=utf-8">No, it would apply on login, not just password change. The proposal says it would apply when “<span style="-webkit-text-size-adjust: auto; font-family: Lato; white-space: pre-wrap; -webkit-tap-highlight-color: rgba(255, 255, 255, 0);">A user enters a password during Account Setup, Password Change, Password Reset or User Login in ARIN Online.</span>“ <div><br></div><div>Note the “or User Login” clause. </div><div><br></div><div>I support option 3. </div><div><br></div><div>I’m not sure if there is any good way to build a local DB of all compromised passwords: IIUIC, HIBP has a number of non-public databases they check as well as the more widely known ones. Based on that, I support checking against HIBP. <br><div><div dir="ltr"><div><br></div><div>Scott</div></div><div dir="ltr"><br><blockquote type="cite">On Feb 16, 2021, at 9:33 AM, Chris Woodfield <chris@semihuman.com> wrote:<br><br></blockquote></div><blockquote type="cite"><div dir="ltr"><span>Hi John, ARIN staff - </span><br><span></span><br><span>To be clear, is this an operation that would be executed only upon a password change? While I definitely support that flow, I’d be curious if we’re also checking the existing account base against known password leaks.</span><br><span></span><br><span>If this is being checked upon password change, I believe that Option #3 is the best way to go, as this 1. provides immediate protection of the account and 2. Helps educate users as to the hazards of password re-use.</span><br><span></span><br><span>If there’s any planned or existing checks of existing passwords against haveibeenpwned, I’d react to a match with a required password change (with an explanation of the reason why) at next login, or a way to disable the login if the account isn’t logged into within a specific period of time (say, 30 days); this would need to generate a custom message when the user does try to log in that leads to the “forgotten password” flow.</span><br><span></span><br><span>LMK if this helps.</span><br><span></span><br><span>Thanks,</span><br><span></span><br><span>-C</span><br><span></span><br><blockquote type="cite"><span>On Feb 16, 2021, at 8:11 AM, ARIN <info@arin.net> wrote:</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Since October 2020, the ARIN Online system has been subject to a series of dictionary-based password guessing attacks. Because of the protective measures currently in place, some customer accounts were locked during these attacks. ARIN staff has been heavily engaged in mitigating these attacks, and we are seeking community feedback on potential steps ARIN can take to reduce the risk of future attacks and to help customers ensure they are using strong passwords. Password dictionary guessing attacks continue to be a problem in the industry, and this effort should help reduce the extent of previously exposed passwords for our ARIN Online user base.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Password Check Proposal</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>To help ARIN customers make sure they aren’t using a password that has been exposed and shared publicly online, when someone updates their password or creates a user account in ARIN Online, it is proposed that ARIN should check the database "haveibeenpwned (https://haveibeenpwned.com)" to see if they are trying to use a password that has been compromised. ARIN will not send the password, but rather we encrypt the password and send part of the encrypted password to the Have I been Pwned (HIBP) Service (https://haveibeenpwned.com/API/v3#PwnedPasswords) to see if it matches a compromised password. Actual passwords are never sent or used in any query, nor is your user ID or email shared as part of this check.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>How would it work?</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>1. A user enters a password during Account Setup, Password Change, Password Reset or User Login in ARIN Online. </span><br></blockquote><blockquote type="cite"><span>2. ARIN encrypts the password and sends part of the encrypted password to the Have I been Pwned (HIBP) Service (https://haveibeenpwned.com/API/v3#PwnedPasswords) and returns all possible matches in their database. (Your actual password is never sent or used in any query.) </span><br></blockquote><blockquote type="cite"><span>3. We compare the full encrypted password to the results sent by HIBP to see if there is a match.</span><br></blockquote><blockquote type="cite"><span>4. If there is a match we will notify the customer.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Optional Outcomes</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>We are interested in the community’s thoughts on the possible outcomes when we identify a password that has been exposed in a data breach according to the HIBP service. There are three options:</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>1. Issue a caution message but allow the password.</span><br></blockquote><blockquote type="cite"><span>2. Issue a warning message and notify the customer that they need to change their password within a defined time period, but not at the current point of login.</span><br></blockquote><blockquote type="cite"><span>3. Issue warning message that requires the customer to select and set a different password immediately.</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>The feedback you provide during this consultation will help inform how we move forward to increase security of ARIN Online for all customers. Thank you for your participation in the ARIN Consultation and Suggestion Process. </span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Please provide comments to arin-consult@arin.net. You can subscribe to this mailing list at:</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>http://lists.arin.net/mailman/listinfo/arin-consult</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>This consultation will remain open through 5:00 PM ET on 16 March 2021. </span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>Regards,</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>John Curran </span><br></blockquote><blockquote type="cite"><span>President and CEO </span><br></blockquote><blockquote type="cite"><span>American Registry for Internet Numbers (ARIN)</span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span></span><br></blockquote><blockquote type="cite"><span>_______________________________________________</span><br></blockquote><blockquote type="cite"><span>ARIN-Announce</span><br></blockquote><blockquote type="cite"><span>You are receiving this message because you are subscribed to</span><br></blockquote><blockquote type="cite"><span>the ARIN Announce Mailing List (ARIN-announce@arin.net).</span><br></blockquote><blockquote type="cite"><span>Unsubscribe or manage your mailing list subscription at:</span><br></blockquote><blockquote type="cite"><span>https://lists.arin.net/mailman/listinfo/arin-announce</span><br></blockquote><blockquote type="cite"><span>Please contact info@arin.net if you experience any issues.</span><br></blockquote><span></span><br><span>_______________________________________________</span><br><span>ARIN-Consult</span><br><span>You are receiving this message because you are subscribed to the ARIN Consult Mailing</span><br><span>List (ARIN-consult@arin.net).</span><br><span>Unsubscribe or manage your mailing list subscription at:</span><br><span>https://lists.arin.net/mailman/listinfo/arin-consult Please contact the ARIN Member Services</span><br><span>Help Desk at info@arin.net if you experience any issues.</span><br></div></blockquote></div></div></div></body></html>