Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

theregister.co.uk

Post reply on HN
Print view View original

31–40 of 58 posts

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#31

Post by zeveb »

manyxcxi wrote: post #8
continuations wrote: post #2

Does this mean LinkedIn stores unencrypted passwords? That's pretty hard to believe.

In 2012 (the hack which this came from) their passwords were encrypted with SHA1 and not salted. I have a feeling that today things are better than that, but who knows, maybe not.

> In 2012 (the hack which this came from) their passwords were encrypted with SHA1 and not salted.

The passwords were hashed with SHA1, not encrypted.

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#32

Post by 6stringmerc »

Fiaxhs wrote: post #30
6stringmerc wrote: post #12

I guess he really liked that Volkswagen commercial?[1] [1] https://www.youtube.com/watch?v=jdccNAOvPHg

You read the article about Subaru and lesbians, right?

I sure did! It was a great study and quite fascinating from a marketing perspective.

I do remember in middle school (a religious one) a classmate got in trouble (detention?) for loudly wondering if the Biology teacher and softball coach in her 30s with short hair and drove an Isuzu Rodeo might be a lesbian.

Re: Mark Zuckerberg's Twitter and Pinterest password was 'dadada'

#33

Post by tremon »

EGreg wrote: post #22
reitanqild wrote: post #16

Earlier quoted context omitted.

> What if the salt was derived from a key the user had to supply and wasn't stored anywhere? If I understood you that is the same as demanding the user to input two strings for password authentication, one for salt and one for password, in which case you might just as well require the user to use a longer password.

Good point. Why do we have passwords anyway? Just to authenticate at unanticipated access points? We could always just do two-factor authentication for that. A code would be sent to Google Authenticator on your phone or something like that, encrypted with your public key, and you'd just decrypt it with your private key. The phone would be secured with your password or fingerprint, which is never sent anywhere. The co…

We use passwords both to authenticate (assert identity) and to authorize (declare intent). The problem with automated logins is that you cannot infer intent (i.e. you have no assurance that the user actually meant to log in to your service).
Post reply on HN