Passwords for 32M Twitter accounts may have been hacked and leaked
1–10 of 199 posts
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#2I have received 3 warnings about suspicious activity on a twitter account I haven't used since 2011. I wonder how old that leak is.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#3Thats nothing compared to the amount of fake twitter accounts for paid followers. Probably in the range of 100s of millions of accounts. For the downvoters, or doubters, goto https://www.fiverr.com/ and see if you don't find these services being offered all over the damn place. 1 million followers for 20 bucks.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#4I have received 3 warnings about suspicious activity on a twitter account I haven't used since 2011. I wonder how old that leak is.
I also keep getting these for a relative inactive account. I assumed phishing since the subject of the email was "suspicious sign in detected" but the content made no claim of successful sign in.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#5Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of those user accounts at all, aside from the obvious that their username is known?
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#6Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of…
It would allow you to bruteforce the passwords without any sort of rate limiting. So, if you used a dictionary, you probably could get quite a few weak passwords in a short amount of time relative to a system that had proper rate limiting to prevent these kinds of attacks.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#7Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of…
It would allow you to bruteforce the passwords without any sort of rate limiting. So, if you used a dictionary, you probably could get quite a few weak passwords in a short amount of time relative to a system that had proper rate limiting to prevent these kinds of attacks.
Ah derp. Totally forgot about rate limiting. Thank you.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#8Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of…
I suppose the main danger is the possibility that someone might, at some point in the future if processing power should suddenly take a leap forward, come up with a way to crack them.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#9Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of…
It's an interesting thought, but it would be a catastrophe. Even if you can't brute force strong passwords due to many rounds of hashing, you can still check the hashes/salts against common passwords. You can't do a rainbow table attack, but you can do a dictionary attack.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#10Twitter also does 2-Factor Auth. If you value your Twitter account, in addition to changing your password (which hopefully is unique amongst your accounts), also activate 2FA.