Who has 123456 as their password in 2016!? Oh, wait... 120,417 people apparently. :: head in hands ::
You would be surprised how many people in India (and elsewhere, for that matter), have that as their online banking password.
Passwords for 32M Twitter accounts may have been hacked and leaked
191–199 of 199 posts
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#192Twitter also does 2-Factor Auth. If you value your Twitter account, in addition to changing your password (which hopefully is unique amongst your accounts), also activate 2FA.
I am trying to activate that as we speak, but I never get the SMS. I tried 6 times in the last 3 hours. I guess it's overloaded or broken at least for my phone number (german mobile phone).
I work for a company that utilizes texting to customers, we do this now via email, ie 1233451234@vtext.com for Verizon and there are others for the different carriers. These carriers are beginning to put a halt to this and are starting to require you to sign up and pay them to send SMS messages. Soon my company will not be able to send any SMS without paying the carriers. Perhaps this is the problem?
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#193Earlier quoted context omitted.
With bcrypt you can set a parameter which determines how slow it is. So if hardware gets faster, you can change the parameter. (brcrypt uses 2^n iterations where n is the parameter.) So it doesn't matter on what hardware, if you want bcrypt to take 1 second on modern hardware (for any value of "modern"), you can.
It seems like implementing a security strength which is a function of the current practical CPU speed is a recipe which could lead to disaster in the future, mainly because of how reluctant some companies are to change existing systems once they are in place. The concept actually makes sense, but it kind of assumes that the strength of the security will be increased at the same rate of which technology progresses, wh…
Depends on how you design your password system... once upgraded a password system by putting a marker with the pwd for newer encoding... this way it can be upgraded as users login.. after n% of users have rolled to the new system, or x days, you can disable the other accounts and require they reset/recover their password for use.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#194Earlier quoted context omitted.
And don't forget, that every 18 months, the amount of processing power you get for a modest price, doubles.
Not anymore. It's hard to get specific numbers about a trend that just changed. But the double every 18 months is now clearly wrong. We've got a couple of approximately 27 months doubling, but that is past too. My bet is that we won't get a fixed number ever again.
I'm not sure the fastest per core speed for the last 5 years in CPUs is significantly faster.. more cores, more caches for some operations, but not nearly the growth we used to see.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#195Earlier quoted context omitted.
Then why even bother with bcrypt?
Because something with a cryptographic hash, like sha256, you can do millions (or in some cases billions) of hashes per second on the same GPU. Password hashes, like bcrypt, PBKDF2 and scrypt, are massively slower. That doesn't mean they're uncrackable, it just means they are expensive to crack, so a strong password in a well implemented password hash will take a long time (and cost a lot of money) to crack, by which…
Yes if your password looks like: z1c4KzC*ITtt4Ka%vVDeei!aFSuEOTiDFCJ2NXc8Z7Jz then we are looking at enough time for you as a user to not care.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#196Earlier quoted context omitted.
Not anymore. It's hard to get specific numbers about a trend that just changed. But the double every 18 months is now clearly wrong. We've got a couple of approximately 27 months doubling, but that is past too. My bet is that we won't get a fixed number ever again.
I'm not sure the fastest per core speed for the last 5 years in CPUs is significantly faster.. more cores, more caches for some operations, but not nearly the growth we used to see.
Well, I was surprised by these benchmarks:
http://www.anandtech.com/show/10404/asrock-deskmini-110-mini...
When you compare the skull canyon CPU and the i5 6500:
http://ark.intel.com/compare/93341,88184
The i5 has better specs on pretty much any aspect, but the skull canyon does way better in those benchmarks. I am told the impact is the 128MB eDRAM which acts as a L4 cache.
So maybe that's the way for computers to become much faster, making everything around the CPU go faster. Integrate the RAM and the GPU on the chip. Superfast SSDs. Etc.
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#197Earlier quoted context omitted.
But I can back up the secret in multiple places, and as another commenter mentioned, TOTP is an open spec, so I don't have to rely on exactly one sim card being in range of a cell tower. I have options. My bank requires SMS confirmation every time I send money online, and when I was in the US for 10 days, even with my SIM, I couldn't get SMS's, and thus couldn't do banking. This is extremely annoying.
How is TOTP being an open spec relevant? If $TOTP_APP does not work when you need it, it doesn't really matter. Even with a backed up secret. All I'm really saying is that limited options does not mean "broken". It just means limited options.
It's relevant because it means there are N apps out there instead of the exactly one pair of "my SIM" and "a tower my provider can use to reach my phone."
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#198Does anyone here have a raw download to this data set? I'm a student at a university interested in doing some statistical analysis of passwords for a small project.
If anyone is able to help me, I'd appreciate them emailing me. You can find my email under my account.
It would be a huge help!
Re: Passwords for 32M Twitter accounts may have been hacked and leaked
#199Earlier quoted context omitted.
Right, but you would still bypass the rate limiting of the server whether that be login attempts, http requests per second, firewall rules, latency or whatever when checking.
That's another rate limiting that has nothing to do with the hash strength. Good password hashing functions have internal rate limits that reduce the likelihood of anyone being able to break the hashes easily because they will be expensive even when fully implemented in hardware. For how long are they resilient it's another question but bcrypt is pretty good, it's quite slow, and is expensive to implement in ASIC/FPG…
This is what I was thinking about. Thanks.