Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for 32M Twitter accounts may have been hacked and leaked

techcrunch.com

Post reply on HN
Print view View original

71–80 of 199 posts

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#71

Post by datr »

silversmith wrote: post #65
imrehg wrote: post #22

Earlier quoted context omitted.

Was just trying to set this up, and not great (IMHO). The feature is called "Login Verification", I think, and it's only SMS based, no Google Authenticator / Authy style one-time password... Also, it was saying I needed to verify my email address before that feature can be used, but there was no option to verify the email address that is used since I've registered almost a decade ago... Had to change my email (used t…

Curious, why is SMS-based auth a downside in your opinion? I prefer to use SMS-based 2FA where available, as you can always pop the sim card into whatever device you have on hand and receive the code. As opposed to smartphone app, where you are tied to a particular device being available and in working order.

There have been quite a few cases where malicious actors have been able to convince phone companies to forward sms messages to other numbers via social engineering to defeat this type of 2FA.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#72

Post by supercoder »

varunom wrote: post #59
Tinned_Tuna wrote: post #53

I can finally recover my account!

Someone said to me the other day "There are two types of companies, those that have been hacked, and those that don’t yet know they have been hacked."

there are probably more types

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#73

Post by doublec »

silversmith wrote: post #65
imrehg wrote: post #22

Earlier quoted context omitted.

Was just trying to set this up, and not great (IMHO). The feature is called "Login Verification", I think, and it's only SMS based, no Google Authenticator / Authy style one-time password... Also, it was saying I needed to verify my email address before that feature can be used, but there was no option to verify the email address that is used since I've registered almost a decade ago... Had to change my email (used t…

Curious, why is SMS-based auth a downside in your opinion? I prefer to use SMS-based 2FA where available, as you can always pop the sim card into whatever device you have on hand and receive the code. As opposed to smartphone app, where you are tied to a particular device being available and in working order.

It's possible for an attacker to intercept the SMS based 2FA http://news.softpedia.com/news/ss7-attack-leaves-whatsapp-an...

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#75

Post by nikbackm »

iagooar wrote: post #62
cmdrfred wrote: post #51

Earlier quoted context omitted.

1 week only tests 1 password. It would have to run for years to get a decent set of results. I don't see how a company can afford all that hardware and power to do something that is illegal to begin with. How do they monetize it to get a return?

And don't forget, that every 18 months, the amount of processing power you get for a modest price, doubles.

Still?

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#76

Post by scrollaway »

datr wrote: post #71
silversmith wrote: post #65

Earlier quoted context omitted.

Curious, why is SMS-based auth a downside in your opinion? I prefer to use SMS-based 2FA where available, as you can always pop the sim card into whatever device you have on hand and receive the code. As opposed to smartphone app, where you are tied to a particular device being available and in working order.

There have been quite a few cases where malicious actors have been able to convince phone companies to forward sms messages to other numbers via social engineering to defeat this type of 2FA.

Additionally, it requires an active phone number, which may not be available to you in general or temporarily.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#77

Post by adrianmsmith »

fit2rule wrote: post #37
cm2187 wrote: post #32

Earlier quoted context omitted.

Depends what you mean by short amount of time. Depending on the strength selected with bcrypt, it can easily take a second to check a hash. On a 30m password database, this will take a year on one machine to check just who is using "monkey" as a password.

> it can easily take a second to check a hash On what hardware?

With bcrypt you can set a parameter which determines how slow it is. So if hardware gets faster, you can change the parameter. (brcrypt uses 2^n iterations where n is the parameter.)

So it doesn't matter on what hardware, if you want bcrypt to take 1 second on modern hardware (for any value of "modern"), you can.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#78

Post by scrollaway »

cdubzzz wrote: post #54
heartsucker wrote: post #39

Earlier quoted context omitted.

To me that's broken because if I travel, change numbers, or have wifi but no cell coverage, I can't access my account.

By that logic, it is also also broken because if you don't have access to your phone or the Google Authtenticator app or phone OS is malfunctioning, you can't access your account.

"Google Authenticator" style 2fa is an open spec. You can build your own authenticator to your own liking.

So no, "by that logic" doesn't apply. You can choose to use something else than a phone to auth, but if it's SMS based well... I just came back from a week in France where I had zero cell connectivity. Had I been using any kind of SMS based 2fa, I would have lost access to those accounts with no forewarning.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#80

Post by nailer »

Olscore wrote: post #5

Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of…

I thought this was from a phishing attack - eg, plaintext, not bcrypt hashes?
Post reply on HN