Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
theregister.co.uk
Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
1–10 of 58 posts
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#2Does this mean LinkedIn stores unencrypted passwords? That's pretty hard to believe.
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#3Does this mean LinkedIn stores unencrypted passwords? That's pretty hard to believe.
It means passwords like dadada can be reversed from hashes.
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#4Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#5Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#6Earlier quoted context omitted.
Not if it's salted, no?
It wasn't salted, but even then a targeted effort could almost certainly crack a password as bad as dadada almost immediately for a fast hash like sha1.
That's what I find hard to believe though. LinkedIn, a $20B giant, doesn't salt its passwords and uses something as weak as sha1? I would expect even a 1-person startup to do better than that.
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#7Earlier quoted context omitted.
It wasn't salted, but even then a targeted effort could almost certainly crack a password as bad as dadada almost immediately for a fast hash like sha1.
That's what I find hard to believe though. LinkedIn, a $20B giant, doesn't salt its passwords and uses something as weak as sha1? I would expect even a 1-person startup to do better than that.
That doesn't need to be true for this to have happened. Zuck is a high profile target, probably the hackers just prioritised cracking his account and such a weak password would be found reasonably quickly even using bcrypt
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#8Does this mean LinkedIn stores unencrypted passwords? That's pretty hard to believe.
In 2012 (the hack which this came from) their passwords were encrypted with SHA1 and not salted.
I have a feeling that today things are better than that, but who knows, maybe not.
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#9Who would have guessed he is a dadaist.
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#10Earlier quoted context omitted.
That's what I find hard to believe though. LinkedIn, a $20B giant, doesn't salt its passwords and uses something as weak as sha1? I would expect even a 1-person startup to do better than that.
That doesn't need to be true for this to have happened. Zuck is a high profile target, probably the hackers just prioritised cracking his account and such a weak password would be found reasonably quickly even using bcrypt
Can you prevent targeted attacks, or is salting the state of the art?
What if the salt was derived from a key the user had to supply and wasn't stored anywhere?