I am sure Twitter can grab this list and invalidate all passwords quickly.
Passwords for 32M Twitter accounts may have been hacked and leaked
11–20 of 199 posts
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#12Thats nothing compared to the amount of fake twitter accounts for paid followers. Probably in the range of 100s of millions of accounts. For the downvoters, or doubters, goto https://www.fiverr.com/ and see if you don't find these services being offered all over the damn place. 1 million followers for 20 bucks.
You are likely being downvotesd because the comment is off topic.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#13Thats nothing compared to the amount of fake twitter accounts for paid followers. Probably in the range of 100s of millions of accounts. For the downvoters, or doubters, goto https://www.fiverr.com/ and see if you don't find these services being offered all over the damn place. 1 million followers for 20 bucks.
You are likely being downvotesd because the comment is off topic.
i mean if you try your hardest to make sense of it, maybe he means these could be all fake accounts passwords??
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#14Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of…
It would allow you to bruteforce the passwords without any sort of rate limiting. So, if you used a dictionary, you probably could get quite a few weak passwords in a short amount of time relative to a system that had proper rate limiting to prevent these kinds of attacks.
You'd still need the salt though, right?
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#15Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#16Earlier quoted context omitted.
It would allow you to bruteforce the passwords without any sort of rate limiting. So, if you used a dictionary, you probably could get quite a few weak passwords in a short amount of time relative to a system that had proper rate limiting to prevent these kinds of attacks.
You'd still need the salt though, right?
Bcrypt salts are ordinarily colocated with the hashes and the number of rounds used to compute them.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#17Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of…
I suppose the main danger is the possibility that someone might, at some point in the future if processing power should suddenly take a leap forward, come up with a way to crack them.
Would something like an ASIC help the attacker, I wonder?
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#18Earlier quoted context omitted.
It would allow you to bruteforce the passwords without any sort of rate limiting. So, if you used a dictionary, you probably could get quite a few weak passwords in a short amount of time relative to a system that had proper rate limiting to prevent these kinds of attacks.
You'd still need the salt though, right?
The salt is typically stored with the hashed value. Its purpose is simply to prevent you from being able to use a single dictionary attack on all users.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#19Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of…
I suppose the main danger is the possibility that someone might, at some point in the future if processing power should suddenly take a leap forward, come up with a way to crack them.
eventually at least on PBKDF2 you could also increase the number of rounds taken.
So if somebody logs in you could recalculate the PBKDF2 hash.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#20Twitter also does 2-Factor Auth. If you value your Twitter account, in addition to changing your password (which hopefully is unique amongst your accounts), also activate 2FA.
Just to add, Twitter's 2FA is "broken" because it only has SMS support. You cannot configure an app and I don't want to give Twitter my phone number.