Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for 32M Twitter accounts may have been hacked and leaked

techcrunch.com

Post reply on HN
Print view View original

141–150 of 199 posts

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#141

Post by jfindley »

kerkeslager wrote: post #132
_asummers wrote: post #124

Earlier quoted context omitted.

Additionally, there's a new player in town called Argon2 that attempts to solve the problems with bcrypt and scrypt. It's the most recent winner of the password hashing competition. https://github.com/P-H-C/phc-winner-argon2

What problems with bcrypt/scrypt does argon2 solve?

bcrypt is limited to 72 characters (admittedly this is not that big a practical limitation), and scrypt is an excellent KDF, but wasn't designed as a password hash, and thus doesn't have great GPU defence. In practice, they're still both great, but that doesn't mean we should stop trying to do even better.

Argon2 looks really interesting, but it is still relatively new.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#143

Post by Someone1234 »

kerkeslager wrote: post #132
_asummers wrote: post #124

Earlier quoted context omitted.

Additionally, there's a new player in town called Argon2 that attempts to solve the problems with bcrypt and scrypt. It's the most recent winner of the password hashing competition. https://github.com/P-H-C/phc-winner-argon2

What problems with bcrypt/scrypt does argon2 solve?

It rate limits via IO (specifically memory IO) rather than processing power (CPU/GPU).

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#144

Post by breakend »

0xfaded wrote: post #142

Just got the email: Your account may have been compromised by a website or service not associated with Twitter. I'd like to know how Twitter credentials were compromised from outside Twitter.

Like they said in the article, Twitter uses bcrypt to store your password, but many of the passwords in the dump were plain text. This suggests that they were scraped together from external sources (i.e. malware on your machine, re-use of a password from one of the other dumps like LinkedIn). Hence, compromised from outside Twitter.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#145

Post by hnal943 »

geekamongus wrote: post #115
colinbartlett wrote: post #98

Earlier quoted context omitted.

Airplanes are a big one for me as a frequent traveler. Every plane has wifi but you can't receive SMS. If my previous cookie expired or the site thinks the plane's IP is new and strange, then I might have no way to sign in from the air.

How much tweeting do you do on an average flight?

Reading tweets is perfect for a flight, it's a never-ending stream of entertaining information that doesn't require a lot of concentration.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#146

Post by mbrd »

Does anyone know the significance of the date 9-11-1961? The password list has 10,444 matches for "9-11-1961" and 10,231 for "9111961".

From Wikipedia, I see that Hurricane Carla hit Texas that day but that doesn't seem noteworthy enough to warrant two instances of the date in the top 20, It would be surprising if it was only due to date of birth too, given I can't spot any other date-like entries.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#147

Post by hammock »

mbrd wrote: post #146

Does anyone know the significance of the date 9-11-1961? The password list has 10,444 matches for "9-11-1961" and 10,231 for "9111961". From Wikipedia, I see that Hurricane Carla hit Texas that day but that doesn't seem noteworthy enough to warrant two instances of the date in the top 20, It would be surprising if it was only due to date of birth too, given I can't spot any other date-like entries.

Could have been a single person mass-creating accounts

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#148

Post by Someone1234 »

Strom wrote: post #135
jfindley wrote: post #92

Earlier quoted context omitted.

What? No. Don't use a fixed salt. Each record should have a unique, random salt. You then store salt:hash(salt+password). There are numerous guides on how to do this properly, for example https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet

Using a site-specific constant combined with the user's e-mail as the salt isn't too horrible. The owasp link you provided explains the two goals of using a salt: 1) Not being able to tell two passwords are identical based on the resulting hash. The e-mail is unique per user, so even if a bunch of users have "password" as their password, the hashes will all be different. Yes, if a user changes their password from "pa…

A site specific constant is often called a "Pepper" as an aside. Just helps people google it if they want more information.

Several implementations utilise a Salt + Papper (unique per user value and single per site value). A Pepper is particularly useful when it is NOT stored in the database (e.g. stored in an environmental variable or even code). That way if someone steals your database via SQL Injection or a database backup file, they'd have to break the Pepper to recover passwords.

Peppers only make sense when they're almost "free" to implement. A slow hashing scheme is the most important thing, then unique salting, and finally a pepper last (since a pepper adds the least security wise).

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#149

Post by arprocter »

mbrd wrote: post #146

Does anyone know the significance of the date 9-11-1961? The password list has 10,444 matches for "9-11-1961" and 10,231 for "9111961". From Wikipedia, I see that Hurricane Carla hit Texas that day but that doesn't seem noteworthy enough to warrant two instances of the date in the top 20, It would be surprising if it was only due to date of birth too, given I can't spot any other date-like entries.

I was wondering the same thing

"cepetsugih" and "exigent" seem like odd ones too

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#150

Post by cpncrunch »

campuscodi wrote: post #58

Can someone change the op's link to: https://www.leakedsource.com/blog/twitter The real source, not this redundant media crap that buried the lede...

>Can someone change the op's link to: >https://www.leakedsource.com/blog/twitter

No, let's not. First of all, leakedsource has already been submitted separately, but has fewer upvotes. Presumably people prefer the techcrunch version.

It's not really surprising, as leakedsource's article is poorly laid out. It doesn't even have a title (they've put "Preface" as a title, but that's the heading of the first section). Then there's the banner adverts at the top.

>The real source, not this redundant media crap that buried the lede...

The techcrunch article has responses from twitter and others, along with some analysis, so it's not "redundant media crap".

Post reply on HN