Passwords for 32M Twitter accounts may have been hacked and leaked • Hacker News Board

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#81

Post by cm2187 » Thu, Jun 09, 2016, 11:09 AM UTC

creshal wrote: post #66

cm2187 wrote: post #42

Earlier quoted context omitted.

An i7 laptop. But even if you use an 18 cores server, it doesn't really change the point. It might take a month instead of a year. But it still doesn't scale, even to only check the most common passwords.

https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... 107 kHashes/second/machine for bcrypt in default settings (which probably many sites will use).

In the comment at the bottom it says: bcrypt work factor is 5, scrypt work factor is N=1024 r=1, and PBKDF2 rounds are set to 1,000.

If they did indeed use a work factor of 5 then this analysis is pretty much meaningless for bcrypt. The default is 10 and I usually use 12 myself.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#82

Post by eumoria » Thu, Jun 09, 2016, 11:12 AM UTC

Who has 123456 as their password in 2016!? Oh, wait... 120,417 people apparently. ::head in hands::

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#83

Post by wodenokoto » Thu, Jun 09, 2016, 11:15 AM UTC

eumoria wrote: post #82

Who has 123456 as their password in 2016!? Oh, wait... 120,417 people apparently. :: head in hands ::

Who has a twitter account they don't care about, even at sign-up? Probably millions of people.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#84

Post by dingaling » Thu, Jun 09, 2016, 11:19 AM UTC

silversmith wrote: post #65

imrehg wrote: post #22

Earlier quoted context omitted.

Was just trying to set this up, and not great (IMHO). The feature is called "Login Verification", I think, and it's only SMS based, no Google Authenticator / Authy style one-time password... Also, it was saying I needed to verify my email address before that feature can be used, but there was no option to verify the email address that is used since I've registered almost a decade ago... Had to change my email (used t…

Curious, why is SMS-based auth a downside in your opinion? I prefer to use SMS-based 2FA where available, as you can always pop the sim card into whatever device you have on hand and receive the code. As opposed to smartphone app, where you are tied to a particular device being available and in working order.

> Curious, why is SMS-based auth a downside in your opinion?

If I go 40 miles south I'm in ( the Republic of ) Ireland and can't receive SMS.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#85

Post by k_ » Thu, Jun 09, 2016, 11:20 AM UTC

yawniek wrote: post #33

why the heck is 9111961 and 9-11-1961 such a popular password? botfarm?

WWF supporters? http://www.onthisday.com/date/1961/september/11

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#86

Post by mrweasel » Thu, Jun 09, 2016, 11:22 AM UTC

eumoria wrote: post #82

Who has 123456 as their password in 2016!? Oh, wait... 120,417 people apparently. :: head in hands ::

Bots? Combines with the insane high number of mail.ru it would be my guess that mail.ru has made it easy to creates account in some automatic way and that's what the bots are using, along with a silly password.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#87

Post by return0 » Thu, Jun 09, 2016, 11:22 AM UTC

campuscodi wrote: post #58

Can someone change the op's link to: https://www.leakedsource.com/blog/twitter The real source, not this redundant media crap that buried the lede...

> Subscribe today to view the raw data itself and receive unlimited searches! As low as $0.76 a day!

Is that site legit ?

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#88

Post by irremediable » Thu, Jun 09, 2016, 11:23 AM UTC

sitharus wrote: post #49

irremediable wrote: post #38

Earlier quoted context omitted.

What exactly are you asking here? I read it as saying the 2FA somehow "leaks", but that doesn't make sense, so I think I've misunderstood you.

Hardware/Software 2FA tokens are based on a PRNG with a shared seed. If the table with passwords was accessed it's likely the table with 2FA seeds is hacked. Twitter uses a one-time code sent via sms so I don't think this would be an issue unless the hack is persistent.

> Hardware/Software 2FA tokens are based on a PRNG with a shared seed. If the table with passwords was accessed it's likely the table with 2FA seeds is hacked.

Oh, damn. Thanks for pointing this out. I'd never looked into the details of HOTP or TOTP -- I assumed they were using public-key crypto rather than just a hash of shared values. That sucks. :(

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#89

Post by tim333 » Thu, Jun 09, 2016, 11:28 AM UTC

ck2 wrote: post #60

Olscore wrote: post #5

Question: From my understanding bcrypt is designed for security even when the hashed data is leaked. Each piece of data is uniquely salted and hashed to perhaps varying degrees of difficulty. So for a thought experiment, let's say a site made the password column of their user database public. Given an entirely public password column, even with associated usernames, would this have any use or decrease the security of…

How can a salt change on every encoding? There has to be a reference point, no?

You can hash a fixed salt + password + some other user info like surname or email address. That way if you have the salt you can't just compute the hash of salt+"123456" to see who had that, you have to compute separately for each user.

Re: Passwords for 32M Twitter accounts may have been hacked and leaked

#90

Post by tim333 » Thu, Jun 09, 2016, 11:33 AM UTC

>the malware sent every saved username and password from browsers like Chrome and Firefox back to the hackers

I wonder how you protect against that apart from the thing banks do where they say enter the third and six character? Even with those if the malware monitored a few of them it could probably figure your info.