Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Passwords for 32M Twitter accounts may have been hacked and leaked

techcrunch.com

Post reply on HN
Print view View original

31–40 of 199 posts

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#31

Post by shurcooL »

imrehg wrote: post #22
bad_user wrote: post #10

Twitter also does 2-Factor Auth. If you value your Twitter account, in addition to changing your password (which hopefully is unique amongst your accounts), also activate 2FA.

Was just trying to set this up, and not great (IMHO). The feature is called "Login Verification", I think, and it's only SMS based, no Google Authenticator / Authy style one-time password... Also, it was saying I needed to verify my email address before that feature can be used, but there was no option to verify the email address that is used since I've registered almost a decade ago... Had to change my email (used t…

Yeah, no Google Authenticator is a deal breaker for me too.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#32

Post by cm2187 »

andrewmunsell wrote: post #6
Olscore wrote: post #5

Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of…

It would allow you to bruteforce the passwords without any sort of rate limiting. So, if you used a dictionary, you probably could get quite a few weak passwords in a short amount of time relative to a system that had proper rate limiting to prevent these kinds of attacks.

Depends what you mean by short amount of time. Depending on the strength selected with bcrypt, it can easily take a second to check a hash. On a 30m password database, this will take a year on one machine to check just who is using "monkey" as a password.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#34

Post by xerophyte12932 »

andrewmunsell wrote: post #6
Olscore wrote: post #5

Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of…

It would allow you to bruteforce the passwords without any sort of rate limiting. So, if you used a dictionary, you probably could get quite a few weak passwords in a short amount of time relative to a system that had proper rate limiting to prevent these kinds of attacks.

wouldn't the slowness of bcrpyt be a hindrance enough? Of course rate limiting is a much greater barrier, but I thought the whole point of using bcrypt is that its naturally slow and prevents checking several passwords in a short time

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#35

Post by JorgeGT »

thesimpsons1022 wrote: post #13
minimaxir wrote: post #12

Earlier quoted context omitted.

You are likely being downvotesd because the comment is off topic.

i mean if you try your hardest to make sense of it, maybe he means these could be all fake accounts passwords??

Yes, I think this is what he means, that this list could have been leaked from some "bot controller" server/network. Or maybe the bot network wants to quit and is selling their assets.

This would be coherent with Twitter denying a breach, these would be accounts hacked at some point of the past (and some purposefully generated) and added to the bot network database.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#36

Post by tombrossman »

jwildeboer wrote: post #29
bad_user wrote: post #10

Twitter also does 2-Factor Auth. If you value your Twitter account, in addition to changing your password (which hopefully is unique amongst your accounts), also activate 2FA.

I am trying to activate that as we speak, but I never get the SMS. I tried 6 times in the last 3 hours. I guess it's overloaded or broken at least for my phone number (german mobile phone).

I had a terrible time figuring this out too, because the mobile app offers it and provides no feedback as to why it never succeeds. The reason is that Twitter only supports a very limited number of mobile carrier networks. Here's the support page listing them and you can see there are none for Germany: https://support.twitter.com/articles/20170024?lang=de#

All I can suggest is to keep trying every few months. I have been trying for years. My carrier still isn't listed but it finally started working about two weeks ago for me (I'm not in Germany though). Now I have to hope it keeps working with my still unlisted carrier or I risk getting locked out of my account. At least the bad guys are locked out too...

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#37

Post by fit2rule »

cm2187 wrote: post #32
andrewmunsell wrote: post #6

Earlier quoted context omitted.

It would allow you to bruteforce the passwords without any sort of rate limiting. So, if you used a dictionary, you probably could get quite a few weak passwords in a short amount of time relative to a system that had proper rate limiting to prevent these kinds of attacks.

Depends what you mean by short amount of time. Depending on the strength selected with bcrypt, it can easily take a second to check a hash. On a 30m password database, this will take a year on one machine to check just who is using "monkey" as a password.

> it can easily take a second to check a hash

On what hardware?

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#38

Post by irremediable »

zeeZ wrote: post #23
middleclick wrote: post #20

Earlier quoted context omitted.

Just to add, Twitter's 2FA is "broken" because it only has SMS support. You cannot configure an app and I don't want to give Twitter my phone number.

Even if they supported an app (TOTP Google Authenticator style), wouldn't it be likely for the secrets to have been leaked along with the passwords?

What exactly are you asking here? I read it as saying the 2FA somehow "leaks", but that doesn't make sense, so I think I've misunderstood you.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#39

Post by heartsucker »

bad_user wrote: post #24
middleclick wrote: post #20

Earlier quoted context omitted.

Just to add, Twitter's 2FA is "broken" because it only has SMS support. You cannot configure an app and I don't want to give Twitter my phone number.

While that's annoying, I wouldn't call lit broken. Most 2FA-enabled services I know want a phone number first, including Google (and from what I remember Facebook as well). If you're worried about your privacy, which is understandable, buy a prepaid sim card, a cheap phone and use it only for your 2FA accounts. Not sure about the US, but in my country prepaid GSM sim cards are cheap and you don't have to give away yo…

To me that's broken because if I travel, change numbers, or have wifi but no cell coverage, I can't access my account.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#40

Post by goldenkey »

thesimpsons1022 wrote: post #13
minimaxir wrote: post #12

Earlier quoted context omitted.

You are likely being downvotesd because the comment is off topic.

i mean if you try your hardest to make sense of it, maybe he means these could be all fake accounts passwords??

That is what I meant, thank you for clarifying. Too late to edit the post though, it won't let me.
Post reply on HN