Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for 32M Twitter accounts may have been hacked and leaked

techcrunch.com

Post reply on HN
Print view View original

151–160 of 199 posts

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#151

Post by mbrd »

hammock wrote: post #147
mbrd wrote: post #146

Does anyone know the significance of the date 9-11-1961? The password list has 10,444 matches for "9-11-1961" and 10,231 for "9111961". From Wikipedia, I see that Hurricane Carla hit Texas that day but that doesn't seem noteworthy enough to warrant two instances of the date in the top 20, It would be surprising if it was only due to date of birth too, given I can't spot any other date-like entries.

Could have been a single person mass-creating accounts

I did wonder whether there was some batch of "fake" Twitter accounts that all had the same password. That is the most plausible thing I can think of.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#152

Post by iagooar »

cmdrfred wrote: post #119
iagooar wrote: post #62

Earlier quoted context omitted.

And don't forget, that every 18 months, the amount of processing power you get for a modest price, doubles.

Let's say that were true, so in a year and half you will only have to spend 20 years cracking the passwords? Bcrypt is designed for this exact situation and performs pretty well.

I am not saying bcrypt is bad. But thruth is, we have to be constantly challenging our assumptions about security and avoid feeling like the battle is "won".

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#153

Post by geofft »

0xfaded wrote: post #142

Just got the email: Your account may have been compromised by a website or service not associated with Twitter. I'd like to know how Twitter credentials were compromised from outside Twitter.

Password reuse and phishing are also plausible.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#154

Post by stonogo »

cpncrunch wrote: post #150
campuscodi wrote: post #58

Can someone change the op's link to: https://www.leakedsource.com/blog/twitter The real source, not this redundant media crap that buried the lede...

>Can someone change the op's link to: > https://www.leakedsource.com/blog/twitter No, let's not. First of all, leakedsource has already been submitted separately, but has fewer upvotes. Presumably people prefer the techcrunch version. It's not really surprising, as leakedsource's article is poorly laid out. It doesn't even have a title (they've put "Preface" as a title, but that's the heading of the first section). T…

>t doesn't even have a title (they've put "Preface" as a title, but that's the heading of the first section). Then there's the banner adverts at the top.

The title of the page is "LeakedSource Analysis of Twitter.com Leak". I know it's the title because it's in the title tags. The appearance of banner ads is a strange criticism when comparing to a techcrunch page, which is essentially one huge ad for other tech tabloid crap.

The techcrunch article is poorly written; it implies the data may not be genuine because some guy has not confirmed that twitter has been 'breached', while at other points seems to acknowledge the most likely source for this data is malware on users' computers. Which is it?

The statements from Twitter are boilerplate garbage, unworthy of being reproduced in whole or in part.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#155

Post by varikin »

mbrd wrote: post #146

Does anyone know the significance of the date 9-11-1961? The password list has 10,444 matches for "9-11-1961" and 10,231 for "9111961". From Wikipedia, I see that Hurricane Carla hit Texas that day but that doesn't seem noteworthy enough to warrant two instances of the date in the top 20, It would be surprising if it was only due to date of birth too, given I can't spot any other date-like entries.

I also looked up Nov 9, 1961 as most of non-US used day-month-year. Nothing spectacular either.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#156

Post by geofft »

simonswords82 wrote: post #52
fizx wrote: post #46

Earlier quoted context omitted.

RTFA. Twitter didn't get hacked. Browser malware screen-scraped the passwords.

I did RTFA. Do you think a typical end user is going to care the technicalities of how their password might have been leaked? I certainly don't. The takeaway for me is that (yet) another website I entered personal information has leaked it - regardless of how this happened it further damages the trust I have for Twitter. Had I never used Twitter all of this would be a non-event. Please do tell me if you think I'm bei…

It is certainly technically true that if you never had a Twitter account, your Twitter password couldn't have been compromised by non-Twitter means, because you wouldn't have a Twitter password.

But that is about as useful as saying, "If I never had a bank account, then these scammers wouldn't have been able to convince me to give them access to the bank account. Now I have another reason to dislike banks!"

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#157

Post by simonswords82 »

geofft wrote: post #156
simonswords82 wrote: post #52

Earlier quoted context omitted.

I did RTFA. Do you think a typical end user is going to care the technicalities of how their password might have been leaked? I certainly don't. The takeaway for me is that (yet) another website I entered personal information has leaked it - regardless of how this happened it further damages the trust I have for Twitter. Had I never used Twitter all of this would be a non-event. Please do tell me if you think I'm bei…

It is certainly technically true that if you never had a Twitter account, your Twitter password couldn't have been compromised by non-Twitter means, because you wouldn't have a Twitter password. But that is about as useful as saying, "If I never had a bank account, then these scammers wouldn't have been able to convince me to give them access to the bank account. Now I have another reason to dislike banks!"

Bank accounts add huge amounts of value to my life. If my credit card is stolen and used fraudulently, I'm not going to revert to cash :)

Twitter, and Linked In too, have not added any value. And so when they start to become the cause of security concerns I'm going to use them as an excuse to shut my accounts on them.

It gets worse though, because I would bet that most people who do close their accounts on Twitter/Facebook/Linked In et al walk away thinking all of their data has been magically erased. I suspect that this is not the case, so the mere fact that you ever had an account on these platforms leaves you vulnerable to their security risks ad infinitum. That wouldn't be true of a bank.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#158

Post by sdlion »

facepalm wrote: post #101
jfindley wrote: post #93

Earlier quoted context omitted.

You're massively overestimating the strength of bcrypt here. olcHashcat on a single modern GPU will do several thousand hashes per second, depending on work factor and GPU speed.

Then why even bother with bcrypt?

When you have a massive leak, it's better to have under 10 angry users about that they have been hacked (increasing at a slow pace) than most of your userbase raging at you and leaving your service.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#159

Post by heartsucker »

cdubzzz wrote: post #54
heartsucker wrote: post #39

Earlier quoted context omitted.

To me that's broken because if I travel, change numbers, or have wifi but no cell coverage, I can't access my account.

By that logic, it is also also broken because if you don't have access to your phone or the Google Authtenticator app or phone OS is malfunctioning, you can't access your account.

But I can back up the secret in multiple places, and as another commenter mentioned, TOTP is an open spec, so I don't have to rely on exactly one sim card being in range of a cell tower. I have options.

My bank requires SMS confirmation every time I send money online, and when I was in the US for 10 days, even with my SIM, I couldn't get SMS's, and thus couldn't do banking. This is extremely annoying.

Post reply on HN