Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for 32M Twitter accounts may have been hacked and leaked

techcrunch.com

Post reply on HN
Print view View original

91–100 of 199 posts

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#91

Post by nilved »

adrianmsmith wrote: post #77
fit2rule wrote: post #37

Earlier quoted context omitted.

> it can easily take a second to check a hash On what hardware?

With bcrypt you can set a parameter which determines how slow it is. So if hardware gets faster, you can change the parameter. (brcrypt uses 2^n iterations where n is the parameter.) So it doesn't matter on what hardware, if you want bcrypt to take 1 second on modern hardware (for any value of "modern"), you can.

But 1 second of CPU time on your Web server is a lot different than 1 second of CPU time on a supercomputer.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#92

Post by jfindley »

tim333 wrote: post #89
ck2 wrote: post #60

Earlier quoted context omitted.

How can a salt change on every encoding? There has to be a reference point, no?

You can hash a fixed salt + password + some other user info like surname or email address. That way if you have the salt you can't just compute the hash of salt+"123456" to see who had that, you have to compute separately for each user.

What? No. Don't use a fixed salt.

Each record should have a unique, random salt. You then store salt:hash(salt+password).

There are numerous guides on how to do this properly, for example https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#93

Post by jfindley »

cm2187 wrote: post #32
andrewmunsell wrote: post #6

Earlier quoted context omitted.

It would allow you to bruteforce the passwords without any sort of rate limiting. So, if you used a dictionary, you probably could get quite a few weak passwords in a short amount of time relative to a system that had proper rate limiting to prevent these kinds of attacks.

Depends what you mean by short amount of time. Depending on the strength selected with bcrypt, it can easily take a second to check a hash. On a 30m password database, this will take a year on one machine to check just who is using "monkey" as a password.

You're massively overestimating the strength of bcrypt here. olcHashcat on a single modern GPU will do several thousand hashes per second, depending on work factor and GPU speed.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#95

Post by kalleboo »

cmdrfred wrote: post #51
iagooar wrote: post #43

Earlier quoted context omitted.

How can you say it doesn't scale? You just need to spin up a cluster that is powerful enough to get down to let's say a week. The cost of this would be a joke for a company / institution of a certain size.

1 week only tests 1 password. It would have to run for years to get a decent set of results. I don't see how a company can afford all that hardware and power to do something that is illegal to begin with. How do they monetize it to get a return?

> I don't see how a company can afford all that hardware and power to do something that is illegal to begin with.

An evildoer would use stolen credentials, stolen credit cards, or stolen hardware (botnets).

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#96

Post by ajoy39 »

cdnsteve wrote: post #94

Why doesn't Twitter have 2FA or U2F? Problem solved, at least in terms of users not losing reputation within their own social space because someone is posting as them.

twitter does have 2FA. You can either get a login code texted to you whenever you login or use the Twitter app to verify logins from new devices.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#98

Post by colinbartlett »

silversmith wrote: post #65
imrehg wrote: post #22

Earlier quoted context omitted.

Was just trying to set this up, and not great (IMHO). The feature is called "Login Verification", I think, and it's only SMS based, no Google Authenticator / Authy style one-time password... Also, it was saying I needed to verify my email address before that feature can be used, but there was no option to verify the email address that is used since I've registered almost a decade ago... Had to change my email (used t…

Curious, why is SMS-based auth a downside in your opinion? I prefer to use SMS-based 2FA where available, as you can always pop the sim card into whatever device you have on hand and receive the code. As opposed to smartphone app, where you are tied to a particular device being available and in working order.

Airplanes are a big one for me as a frequent traveler. Every plane has wifi but you can't receive SMS. If my previous cookie expired or the site thinks the plane's IP is new and strange, then I might have no way to sign in from the air.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#100

Post by drrob »

bbcbasic wrote: post #17
drrob wrote: post #8

Earlier quoted context omitted.

I suppose the main danger is the possibility that someone might, at some point in the future if processing power should suddenly take a leap forward, come up with a way to crack them.

Would something like an ASIC help the attacker, I wonder?

Or some curious, thousands-of-computers strong grid-based cracking enterprise. I suppose, even constrained by the current state of tech, cracking bcrypt with some kind of massively parallel dictionary attack isn't entirely unfeasible.
Post reply on HN