Home Upgrade Search Memberlist Extras Hacker Tools Award Goals Help Wiki Contact

Twitter Hacked; Company Says 250K Users May Have Been Affected

Link: http://www.wired.com/threatlevel/2013/02...er-hacked/

Anyone know who the hackers did hack Twitter?
I'd like to quote indefinitearticle from Reddit, here:
Quote:The good news is that Twitter implements industry-current security standards reasonably well, especially in terms of password storage. If your account was compromised, then Twitter may have leaked a "salted hash" of your password.
Some background: a hash is a one way function: you can manipulate a plaintext password into a hash, but you can't reverse the process and go from hash to password. Thus if a bad guy has a table of hashes, the only way he can get the passwords is to hash a dictionary of possible passwords and compare his hashes with the stolen hashes.
Twitter uses bcrypt to hash passwords, which is secure in its slowness -- it will take the attacker a long time to crack a single salted hash. The fastest hardware on the market will crack a password salted/hashed with bcrypt once every 12 years. For a site with millions of passwords, a meaningful attack is utterly impractical unless some theoretical flaw is found in bcrypt itself.
So your passwords are actually reasonably safe if the attacker only has the hash they stole from Twitter. But there's significant portion of the internet that does not have a modern security policy. This includes sites that store your password in plaintext -- the attacker doesn't have to do any cracking at all. This is why you need to use different passwords for the various sites you use. If one site with a weak password policy gets owned, you risk your entire digital identity. (This is especially true for email. If you register with a website using your email and the same password you use for that email, then you are taking a huge risk. If I get your email account then it's game over -- every other account is a "reset password" away from being mine.)
tl;dr Use different passwords for the sites you use, and never register for a site using your email address and email password.
- Linky Mc Linky Link

Taking that, I'd say that those hashes are almost useless to the people who got them.
Bad to hear, but I dont use twitter anyways. Sorry for those who has been hacked with thousands of followers and status :/
IMHO, facebook & twitter just a waste of time & I still wonder why people gather there Instead of focusing on learning something.
I'm glad I don't use twitter. Good luck to those who are affected though.
[Image: a3ADdv1.png]
> thankful for not using Twitter that much

(Feb 8, 2013 12:36 PM)Eternity4ever Wrote:  IMHO, facebook & twitter just a waste of time & I still wonder why people gather there Instead of focusing on learning something.
I heavily disagree with you regarding Facebook and Twitter. What you need to realize is social networks contain a huge amount of people, all interested in different things. For me, I'm interested in astrophysics, government corruption, etc so having friends who post regarding a pop song doesn't benefit me what so ever.

Last week I had 487 friends, now I have 302. I've removed EVERYONE I could think of who shit posts, now my news feed is as clean as ever and contains some of the most interesting content I've ever came across. If you want some awesome pages, hit me up. You'll find if you remove all the idiots who don't contribute to your intellect mind, you'll learn much more and will be able to see actual worthy posts.


Possibly Related Threads...
Thread / Author Replies Views Last Post
by MadScientistOct 20, 2025 06:32 PM 6 126 Oct 20, 2025 06:32 PM
Last Post: Mix
by stealth_eclipseFeb 19, 2020 06:29 AM 8 404 Feb 19, 2020 06:29 AM
Last Post: SIM-4018496
by flavoralOct 4, 2019 03:32 PM 20 561 Oct 4, 2019 03:32 PM
Last Post: gloccforty