Who would have guessed he is a dadaist.
Facebook is full of accidental dadaists.
Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
11–20 of 58 posts
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#12I guess he really liked that Volkswagen commercial?[1]
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#13Earlier quoted context omitted.
It means passwords like dadada can be reversed from hashes.
Not if it's salted, no?
Salting protects against rainbow tables, which is just a pre-calculated mapping of hashes to plain-text. Salting does not effect the difficulty of cracking any one single password.
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#14Does this mean LinkedIn stores unencrypted passwords? That's pretty hard to believe.
It means passwords like dadada can be reversed from hashes.
It's not exactly happening in a vacuum. Emails and usernames from previous dumps help people figure out passwords for new accounts when many people are reusing the same silly password everywhere.
For example someone else may have had dadada as a password and isuckat@passwords.com as their email, and their password was discovered via a separate breach on some other site. That other site used shit technology for securing people's passwords. isuckat@passwords.com was in the linkedin dump.
People can probably guess that any hash for isuckat@passwords.com will probably be 'dadada'. Now based on this information figuring out the hash for other users also using 'dadada' as their password is simpler. Multiply by many thousands of people reusing the same stupid password on all their sites.
In other words use a unique password and use a different unique password for each site and service you use. Use a password manager.
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#15Why did the article state that this is a problem even if one is using 2FA? Even if you reuse passwords, 2FA would stop most attacks it seems or slow them down incredibly, where you would be alerted to the multiple attempts to guess the 2FA code before it was actually cracked.
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#16Earlier quoted context omitted.
That doesn't need to be true for this to have happened. Zuck is a high profile target, probably the hackers just prioritised cracking his account and such a weak password would be found reasonably quickly even using bcrypt
Can you prevent targeted attacks, or is salting the state of the art? What if the salt was derived from a key the user had to supply and wasn't stored anywhere?
> What if the salt was derived from a key the user had to supply and wasn't stored anywhere?
If I understood you that is the same as demanding the user to input two strings for password authentication, one for salt and one for password, in which case you might just as well require the user to use a longer password.
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#17Earlier quoted context omitted.
Not if it's salted, no?
It wasn't salted, but even then a targeted effort could almost certainly crack a password as bad as dadada almost immediately for a fast hash like sha1.
Depends if they know the salt. If not and the salt is like 40 random characters it's going to be pretty much uncrackable.
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#18I mean... maybe it's non-trivial passwords that held me back in life
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#19I'm hearing Stefan Remmler suing for 1 Billion.
Hahaha
Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'
#20This reminds me of Gabe Newell whose password was "gaben" when Hackers announced gold status of Half-Life 2 early.