Detecting compromised credentials
View Patent ↗Disclosed are systems, methods, and non-transitory computer-readable storage media for detecting compromised credentials. In some implementations, a content management system can receive information identifying compromised login credentials (e.g., account identifier, password, etc.) from a third party server. The login credentials can be represented by a first hash value generated using a hashing algorithm. When a user logs in to the content management system the user can provide the user's account identifier and password for the content management system. The content management system can generate a second hash value from the user-supplied password using the same hashing algorithm used for the compromised login credentials. The content management system can determine whether the second hash value matches the first hash value and prompt the user to provide a new password for the user's content management system account when the second hash value matches the first hash value.
1. A method comprising:
receiving, by a computing device of a content management system, user login credentials associated with a user account of the content management system, the user login credentials including a first account identifier and an unhashed first password;
obtaining, by the computing device, account login credentials for accounts managed by the content management system, the account login credentials including a plurality of second account identifiers and corresponding second password hash values, the corresponding second password hash values generated using a first hashing algorithm;
generating, by the computing device, a first user password hash value based on a first hashing algorithm and the unhashed first password;
authenticating, by the computing device, the user login credentials based on the first user password hash value and the account login credentials;
obtaining, by the computing device, compromised login credentials including a plurality of third account identifiers and corresponding third password hash values, the corresponding third password hash values generated using a second hashing algorithm distinct from the first hashing algorithm;
generating, by the computing device, a second user password hash value based on the second hashing algorithm and the unhashed first password;
determining, by the computing device, that the unhashed first password is compromised based on the second user password hash value and the compromised login credentials.
2. The method of claim 1 , wherein the compromised login credentials correspond to user accounts with other computing systems distinct from the content management system.
3. The method of claim 1 , further comprising:
receiving, by the computing device, the compromised login credentials from a server device distinct from the content management system.
4. The method of claim 1 , wherein the user login credentials are received from a client device of the content management system operated by a user, and further comprising:
in response to determining that the unhashed first password has been compromised, prompting the user to select a new password for the user account.
5. The method of claim 4 , further comprising:
storing, by the computing device, a collection of compromised password hash values generated using the first hashing algorithm in association with the first account identifier, where each of the compromised password hash values in the a collection of compromised password hash values was generated using the first hashing algorithm; and
preventing, by the computing device, the user from selecting a value for the new password that corresponds to a compromised password hash value in the collection of compromised password hash values.
6. The method of claim 1 , further comprising:
comparing, by the computing device, the second user password hash value and at least one of the third password hash values corresponding to the first account identifier; and
determining, by the computing device, that the unhashed first password has been compromised based on the comparison.
7. The method of claim 1 , wherein the third password hash values are generated based on the first hashing algorithm and the second hashing algorithm.
8. A non-transitory computer-readable medium including one or more sequences of instructions that, when executed by one or more processors, causes:
receiving, by a computing device of a content management system, user login credentials associated with a user account of the content management system, the user login credentials including a first account identifier and an unhashed first password;
authenticating, by the computing device, the user login credentials based on a first user password hash value generated from the unhashed first password using a first hashing algorithm;
determining, by the computing device, that the unhashed first password is compromised based on a second user password hash value generated from the unhashed first password using a second hashing algorithm, where the first hashing algorithm is distinct from the second hashing algorithm.
9. The non-transitory computer-readable medium of claim 8 , further comprising:
obtaining, by the computing device, compromised login credentials including a plurality of third account identifiers and corresponding third password hash values, the corresponding third password hash values generated using the second hashing algorithm, wherein the compromised login credentials correspond to user accounts with other computing systems distinct from the content management system; and
determining, by the computing device, that the unhashed first password has been compromised based on a comparison of the second user password hash value with the compromised login credentials.
10. The non-transitory computer-readable medium of claim 9 , wherein the instructions cause:
receiving, by the computing device, the compromised login credentials from a server device distinct from the content management system.
11. The non-transitory computer-readable medium of claim 9 , wherein the instructions cause:
comparing, by the computing device, the second user password hash value and at least one of the third password hash values corresponding to the first account identifier; and
determining, by the computing device, that the unhashed first password has been compromised based on the comparison.
12. The non-transitory computer-readable medium of claim 9 , wherein the third password hash values are generated based on the first hashing algorithm and the second hashing algorithm.
13. The non-transitory computer-readable medium of claim 8 , wherein the user login credentials are received from a client device of the content management system operated by a user, and wherein the instructions cause:
in response to determining that the unhashed first password has been compromised, prompting the user to select a new password for the user account.
14. The non-transitory computer-readable medium of claim 13 , wherein the instructions cause:
storing, by the computing device, a collection of compromised password hash values generated using the first hashing algorithm in association with the first account identifier, where each of the compromised password hash values in the a collection of compromised password hash values was generated using the first hashing algorithm; and
preventing, by the computing device, the user from selecting a value for the new password that corresponds to a compromised password hash value in the collection of compromised password hash values.
15. A system comprising:
one or more processors; and
a non-transitory computer-readable medium including one or more sequences of instructions that, when executed by the one or more processors, causes:
receiving, by a computing device of a content management system, user login credentials associated with a user account of the content management system, the user login credentials including a first account identifier and an unhashed first password;
authenticating, by the computing device, the user login credentials based on a first user password hash value generated from the unhashed first password using a first hashing algorithm;
determining, by the computing device, that the unhashed first password is compromised based on a second user password hash value generated from the unhashed first password using a second hashing algorithm, where the first hashing algorithm is distinct from the second hashing algorithm.
16. The system of claim 15 , further comprising:
obtaining, by the computing device, compromised login credentials including a plurality of third account identifiers and corresponding third password hash values, the corresponding third password hash values generated using the second hashing algorithm, wherein the compromised login credentials correspond to user accounts with other computing systems distinct from the content management system; and
determining, by the computing device, that the unhashed first password has been compromised based on a comparison of the second user password hash value with the compromised login credentials.
17. The system of claim 16 , wherein the instructions cause:
receiving, by the computing device, the compromised login credentials from a server device distinct from the content management system.
18. The system of claim 16 , wherein the instructions cause:
comparing, by the computing device, the second user password hash value and at least one of the third password hash values corresponding to the first account identifier; and
determining, by the computing device, that the unhashed first password has been compromised based on the comparison.
19. The system of claim 16 , wherein the third password hash values are generated based on the first hashing algorithm and the second hashing algorithm.
20. The system of claim 15 , wherein the user login credentials are received from a client device of the content management system operated by a user, and wherein the instructions cause:
in response to determining that the unhashed first password has been compromised, prompting the user to select a new password for the user account.
21. The system of claim 20 , wherein the instructions cause:
storing, by the computing device, a collection of compromised password hash values generated using the first hashing algorithm in association with the first account identifier, where each of the compromised password hash values in the a collection of compromised password hash values was generated using the first hashing algorithm; and
preventing, by the computing device, the user from selecting a value for the new password that corresponds to a compromised password hash value in the collection of compromised password hash values.