Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for 32M Twitter accounts may have been hacked and leaked

techcrunch.com

Post reply on HN
Print view View original

41–50 of 199 posts

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#41

Post by brian_cloutier »

zeeZ wrote: post #23
middleclick wrote: post #20

Earlier quoted context omitted.

Just to add, Twitter's 2FA is "broken" because it only has SMS support. You cannot configure an app and I don't want to give Twitter my phone number.

Even if they supported an app (TOTP Google Authenticator style), wouldn't it be likely for the secrets to have been leaked along with the passwords?

According to some guy on reddit you are correct: https://www.reddit.com/r/crypto/comments/3et3va/why_does_tot...

The post also gives a justification for using symmetric encryption, it lets the tokens users enter be shorter.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#42

Post by cm2187 »

fit2rule wrote: post #37
cm2187 wrote: post #32

Earlier quoted context omitted.

Depends what you mean by short amount of time. Depending on the strength selected with bcrypt, it can easily take a second to check a hash. On a 30m password database, this will take a year on one machine to check just who is using "monkey" as a password.

> it can easily take a second to check a hash On what hardware?

An i7 laptop. But even if you use an 18 cores server, it doesn't really change the point. It might take a month instead of a year. But it still doesn't scale, even to only check the most common passwords.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#43

Post by iagooar »

cm2187 wrote: post #42
fit2rule wrote: post #37

Earlier quoted context omitted.

> it can easily take a second to check a hash On what hardware?

An i7 laptop. But even if you use an 18 cores server, it doesn't really change the point. It might take a month instead of a year. But it still doesn't scale, even to only check the most common passwords.

How can you say it doesn't scale? You just need to spin up a cluster that is powerful enough to get down to let's say a week. The cost of this would be a joke for a company / institution of a certain size.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#44

Post by simonswords82 »

I didn't need another reason to dislike Twitter but this puts another nail in their coffin, for me at least.

It seems the two platforms I derive the least amount of value from (Twitter and Linked In) are the most vulnerable to hackers and leaked passwords.

I was caught up in the Linked In password debacle recently and now have my e-mail address in the haveIbeenpwned.com database - thanks Linked In. I wonder if I'll get caught up in this mess too.

I only keep my Twitter and Linked In accounts to avoid FOMO (Fear of Missing Out) but this is making me want to shut it all down and erase every trace of personal information I have on both sites.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#45

Post by simonswords82 »

I didn't need another reason to dislike Twitter but this puts another nail in the coffin.

It seems the two platforms I derive the least amount of value from (Twitter and Linked In) are the most vulnerable to hackers and leaked passwords.

I was caught up in the Linked In debacle recently and now have my e-mail address in the haveIbeenpwned.com database - thanks Linked In. I wonder if I'll get caught up in this mess too.

I only keep my Twitter and Linked In accounts to avoid FOMO (Fear of Missing Out) but this is making me want to shut it all down and erase every trace of personal information I have on both sites.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#46

Post by fizx »

simonswords82 wrote: post #44

I didn't need another reason to dislike Twitter but this puts another nail in their coffin, for me at least. It seems the two platforms I derive the least amount of value from (Twitter and Linked In) are the most vulnerable to hackers and leaked passwords. I was caught up in the Linked In password debacle recently and now have my e-mail address in the haveIbeenpwned.com database - thanks Linked In. I wonder if I'll g…

RTFA.

Twitter didn't get hacked. Browser malware screen-scraped the passwords.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#47

Post by dogma1138 »

Olscore wrote: post #30
sintaxi wrote: post #25

Earlier quoted context omitted.

I thought bcrypt was a deliberately slow algorithm so it cant necessarily be brute forced.

Right, but you would still bypass the rate limiting of the server whether that be login attempts, http requests per second, firewall rules, latency or whatever when checking.

That's another rate limiting that has nothing to do with the hash strength.

Good password hashing functions have internal rate limits that reduce the likelihood of anyone being able to break the hashes easily because they will be expensive even when fully implemented in hardware.

For how long are they resilient it's another question but bcrypt is pretty good, it's quite slow, and is expensive to implement in ASIC/FPGA.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#48

Post by fredley »

Olscore wrote: post #5

Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of…

bcrypt and other modern hashing algorithms allow strengthening your hashes (by computing more iterations) at a later date should technological advances make your current number of rounds too weak. This allows you to 'upgrade' your password hashes from 20 rounds to 20,000 without needing the user to re-enter their password. If you publish your hashes at any point, you lose the benefits of this, if your hashes become weakened by technological progress you need to reset your users' passwords.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#49

Post by sitharus »

irremediable wrote: post #38
zeeZ wrote: post #23

Earlier quoted context omitted.

Even if they supported an app (TOTP Google Authenticator style), wouldn't it be likely for the secrets to have been leaked along with the passwords?

What exactly are you asking here? I read it as saying the 2FA somehow "leaks", but that doesn't make sense, so I think I've misunderstood you.

Hardware/Software 2FA tokens are based on a PRNG with a shared seed. If the table with passwords was accessed it's likely the table with 2FA seeds is hacked.

Twitter uses a one-time code sent via sms so I don't think this would be an issue unless the hack is persistent.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#50

Post by zeeZ »

irremediable wrote: post #38
zeeZ wrote: post #23

Earlier quoted context omitted.

Even if they supported an app (TOTP Google Authenticator style), wouldn't it be likely for the secrets to have been leaked along with the passwords?

What exactly are you asking here? I read it as saying the 2FA somehow "leaks", but that doesn't make sense, so I think I've misunderstood you.

Almost everyone here was talking about a leaked database of accounts, so I went with that if the database leaks, shared secret 2FA is useless.

The article says data may have come from user input, so yeah, 2FA would actually help there and wouldn't "leak".

Post reply on HN