Live data from Hacker News

Passwords for 32M Twitter accounts may have been hacked and leaked

techcrunch.com

21–30 of 199 posts

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#21
post #5

Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of…

It would substantially reduce the security of the system.

A large percentage of passwords are on the top-10000 password list, and for such passwords it is easy to reverse the hash using brute force

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#22

Twitter also does 2-Factor Auth. If you value your Twitter account, in addition to changing your password (which hopefully is unique amongst your accounts), also activate 2FA.

Was just trying to set this up, and not great (IMHO).

The feature is called "Login Verification", I think, and it's only SMS based, no Google Authenticator / Authy style one-time password... Also, it was saying I needed to verify my email address before that feature can be used, but there was no option to verify the email address that is used since I've registered almost a decade ago... Had to change my email (used the username+somestring@gmail.com trick to reuse my address, as one email can be used with only one twitter account...) then change it back.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#23

Twitter also does 2-Factor Auth. If you value your Twitter account, in addition to changing your password (which hopefully is unique amongst your accounts), also activate 2FA.

Just to add, Twitter's 2FA is "broken" because it only has SMS support. You cannot configure an app and I don't want to give Twitter my phone number.

Even if they supported an app (TOTP Google Authenticator style), wouldn't it be likely for the secrets to have been leaked along with the passwords?

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#24

Twitter also does 2-Factor Auth. If you value your Twitter account, in addition to changing your password (which hopefully is unique amongst your accounts), also activate 2FA.

Just to add, Twitter's 2FA is "broken" because it only has SMS support. You cannot configure an app and I don't want to give Twitter my phone number.

While that's annoying, I wouldn't call lit broken. Most 2FA-enabled services I know want a phone number first, including Google (and from what I remember Facebook as well).

If you're worried about your privacy, which is understandable, buy a prepaid sim card, a cheap phone and use it only for your 2FA accounts. Not sure about the US, but in my country prepaid GSM sim cards are cheap and you don't have to give away your ID to buy one (though this may change soon).

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#25
post #7

Earlier quoted context omitted.

It would allow you to bruteforce the passwords without any sort of rate limiting. So, if you used a dictionary, you probably could get quite a few weak passwords in a short amount of time relative to a system that had proper rate limiting to prevent these kinds of attacks.

Ah derp. Totally forgot about rate limiting. Thank you.

I thought bcrypt was a deliberately slow algorithm so it cant necessarily be brute forced.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#26
post #5

Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of…

> would this have any use or decrease the security of those user accounts at all

Yes:

http://www.pxdojo.net/2015/08/what-i-learned-from-cracking-4...

Now, this assumes typical storage, that "leaking the password column" means leaking hashed password+salt. Without the salt, things would go slower - but it's sort of an artificial constraint - what you're talking about, is leaking the stuff the server needs to have to check a valid password. And that generally means the hash and the salt.

More generally, there's an upper bound on how difficult it can be made for the server to verify a password; conceptually this is: ((the amount of time a user is willing to wait to be logged in) - overhead) / (resources available on the server for checking the password)

Ok. You don't actually divide the time by the resources, but the point is that if you have 10.000 (valid) logins a minute, you probably can't dedicate 4 high-end GPUs on max throttle for 1 second to check every login attempt.

But an attacker might have those kind of resources. Which means, there's a very real practical limit to how hard it can be made to validate a password guess (a cracking attempt) -- and it will be some small fraction of the time your server takes to validate a login.

Which means that no "easy" passwords (eg: dictionary words) are ever "safe" passwords (safe against an off-line attack).

My guesstimate (mostly pulled out of thin air, and late night napkin "calculations") are that for any password to be "secure" it would need ~64 bits of entropy. Maybe that's a high estimate, given a solid work factor, but I don't think so.

The problem is, that 64 bits is actually quite a lot of information to memorize. In short: you'll likely only remember one or two such passwords. Use them to lock your password manager, and have machine generated random passwords for the rest (because what you don't want is to ever re-use passwords, as passwords are generally always susceptible to sniffing, shoulder-surfing, being filmed, keylogged or otherwise captured in plain text).

For a little more about some of my thoughts on generating passwords that are secure, friendly to current systems ("password rules"), friendly to humans (feasible to remember and type from memory without visual feedback), see these comments: https://news.ycombinator.com/item?id=11772700

(I keep coming back to this idea, but so far I've concluded that 64, 96 and 128 bits is rather a lot to type in, almost no matter how it's encoded. So I'm not sure how useful such a system will end up being. But maybe I'll finally just prototype it, and ask for help in testing it (the "security" part is intentionally trivial, but the usability part is the interesting bit -- will it actually help us in using secure, machine generated passwords, or will we still have trouble remembering them?)

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#27
post #14

Earlier quoted context omitted.

It would allow you to bruteforce the passwords without any sort of rate limiting. So, if you used a dictionary, you probably could get quite a few weak passwords in a short amount of time relative to a system that had proper rate limiting to prevent these kinds of attacks.

You'd still need the salt though, right?

The salt is usually stored with the hash. It prevents using pre-calculated rainbow tables. Without a salt you can check a password guess against all passwords. With a salt you can only test the guess against a single password.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#28
post #25
post #7

Earlier quoted context omitted.

Ah derp. Totally forgot about rate limiting. Thank you.

I thought bcrypt was a deliberately slow algorithm so it cant necessarily be brute forced.

But still much faster than an HTTP request to an Auth API that allows only, say, 5 requests per minute.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#29

Twitter also does 2-Factor Auth. If you value your Twitter account, in addition to changing your password (which hopefully is unique amongst your accounts), also activate 2FA.

I am trying to activate that as we speak, but I never get the SMS. I tried 6 times in the last 3 hours. I guess it's overloaded or broken at least for my phone number (german mobile phone).

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#30
post #25
post #7

Earlier quoted context omitted.

Ah derp. Totally forgot about rate limiting. Thank you.

I thought bcrypt was a deliberately slow algorithm so it cant necessarily be brute forced.

Right, but you would still bypass the rate limiting of the server whether that be login attempts, http requests per second, firewall rules, latency or whatever when checking.
Post reply on HN