Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for 32M Twitter accounts may have been hacked and leaked

techcrunch.com

Post reply on HN
Print view View original

111–120 of 199 posts

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#111

Post by jfindley »

DasIch wrote: post #109
jfindley wrote: post #92

Earlier quoted context omitted.

What? No. Don't use a fixed salt. Each record should have a unique, random salt. You then store salt:hash(salt+password). There are numerous guides on how to do this properly, for example https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet

Though of coure you don't actually do that, you use something like bcrypt that does this for you.

Yes absolutely this - I was just trying to explain how salts should implemented - in the real world always use something like bcrypt or scrypt that does all this for you.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#112

Post by marcosdumay »

iagooar wrote: post #62
cmdrfred wrote: post #51

Earlier quoted context omitted.

1 week only tests 1 password. It would have to run for years to get a decent set of results. I don't see how a company can afford all that hardware and power to do something that is illegal to begin with. How do they monetize it to get a return?

And don't forget, that every 18 months, the amount of processing power you get for a modest price, doubles.

Not anymore.

It's hard to get specific numbers about a trend that just changed. But the double every 18 months is now clearly wrong.

We've got a couple of approximately 27 months doubling, but that is past too. My bet is that we won't get a fixed number ever again.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#113

Post by cdnsteve »

granos wrote: post #105
cdnsteve wrote: post #94

Why doesn't Twitter have 2FA or U2F? Problem solved, at least in terms of users not losing reputation within their own social space because someone is posting as them.

They do. In fact, I just logged in to change my password and had to go get my phone from another room so I could read the code. The annoying thing is that they don't support Google Authenticator or some other TOTP/HOTP token generator. It sucks trying to log into services that use SMS based 2FA when you are not in an are where you get cell reception.

App based 2FA seems extremely limiting. I don't want to install their app on my phone.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#115

Post by geekamongus »

colinbartlett wrote: post #98
silversmith wrote: post #65

Earlier quoted context omitted.

Curious, why is SMS-based auth a downside in your opinion? I prefer to use SMS-based 2FA where available, as you can always pop the sim card into whatever device you have on hand and receive the code. As opposed to smartphone app, where you are tied to a particular device being available and in working order.

Airplanes are a big one for me as a frequent traveler. Every plane has wifi but you can't receive SMS. If my previous cookie expired or the site thinks the plane's IP is new and strange, then I might have no way to sign in from the air.

How much tweeting do you do on an average flight?

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#116

Post by tim333 »

jfindley wrote: post #111
DasIch wrote: post #109

Earlier quoted context omitted.

Though of coure you don't actually do that, you use something like bcrypt that does this for you.

Yes absolutely this - I was just trying to explain how salts should implemented - in the real world always use something like bcrypt or scrypt that does all this for you.

OK, I think I got my terminology wrong. But my thinking was that as well as using bcrypt or whatever on the info in the database you can add some random value stored in code rather than in the database so if your database is compromised it's still a job for them to crack it. Not quite sure what you call that.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#117

Post by broodbucket »

nailer wrote: post #79
campuscodi wrote: post #58

Can someone change the op's link to: https://www.leakedsource.com/blog/twitter The real source, not this redundant media crap that buried the lede...

dang - ping! (I think he has a regex!)

Needs some sophisticated language parsing to filter out expressions of mild disappointment.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#118

Post by Unklejoe »

adrianmsmith wrote: post #77
fit2rule wrote: post #37

Earlier quoted context omitted.

> it can easily take a second to check a hash On what hardware?

With bcrypt you can set a parameter which determines how slow it is. So if hardware gets faster, you can change the parameter. (brcrypt uses 2^n iterations where n is the parameter.) So it doesn't matter on what hardware, if you want bcrypt to take 1 second on modern hardware (for any value of "modern"), you can.

It seems like implementing a security strength which is a function of the current practical CPU speed is a recipe which could lead to disaster in the future, mainly because of how reluctant some companies are to change existing systems once they are in place.

The concept actually makes sense, but it kind of assumes that the strength of the security will be increased at the same rate of which technology progresses, which I don’t think will always be the case. This is especially true when you consider potential “bursts” in computation speed progression.

That being said, I’m not implying that I have a better idea. Running algorithms that take 30 seconds to execute isn’t going to work for logging into your Twitter account either.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#119

Post by cmdrfred »

iagooar wrote: post #62
cmdrfred wrote: post #51

Earlier quoted context omitted.

1 week only tests 1 password. It would have to run for years to get a decent set of results. I don't see how a company can afford all that hardware and power to do something that is illegal to begin with. How do they monetize it to get a return?

And don't forget, that every 18 months, the amount of processing power you get for a modest price, doubles.

Let's say that were true, so in a year and half you will only have to spend 20 years cracking the passwords? Bcrypt is designed for this exact situation and performs pretty well.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#120

Post by nashashmi »

cdnsteve wrote: post #113
granos wrote: post #105

Earlier quoted context omitted.

They do. In fact, I just logged in to change my password and had to go get my phone from another room so I could read the code. The annoying thing is that they don't support Google Authenticator or some other TOTP/HOTP token generator. It sucks trying to log into services that use SMS based 2FA when you are not in an are where you get cell reception.

App based 2FA seems extremely limiting. I don't want to install their app on my phone.

Doesn't have to be just their app. There are plenty of apps and chrome extensions that mimic authenticator ability.
Post reply on HN