20 ms·

Mark Zuckerberg's Twitter and Pinterest Accounts Hacked from Linkedin Breach

63 points by petulla 10y ago

danso 10y ago
FWIW, his password was apparently "dadada". But he basically never used Twitter (didn't follow him on Pinterest), so he probably did what a lot of people do for services they don't really intend on seriously using (except most people seriously use those social media services), which is to just make up a silly password for all of them. Even so, probably should've picked something a little stronger than that...
- deleted 10y ago
  [deleted]
- dawhizkid 10y ago
  Optics are really bad here. This is from LinkedIn, so he used a terrible password on at least 3+ large social media websites (and what else?).
  - petulla 10y ago
    It is a wonder how no one was worrying about this..
    - 6stringmerc 10y ago
      If I was the underwriter for FB's D&O / Cyber policy about now I'd be making some very uncomfortable phone calls to important people.
  - ForHackernews 10y ago
    > at least 3+ large social media websites Three "large" sites that he didn't use or care about. I have a twitter account that I posted one tweet on in 2013. The password is "mystupidpassword" -- have at it, hackers.
    - dawhizkid 10y ago
      You're not Mark Zuckerberg.
      - ForHackernews 10y ago
        Zuckerberg clearly doesn't give a shit about his Pintrest, either.
  - exolymph 10y ago
    I have crappy passwords on old accounts that I created before I started using LastPass... but I'm also an irrelevant normal person, not a billionaire CEO at an extremely powerful company. Very silly of Zuck (and really, I should go change my old passwords too).
- laurencei 10y ago
  But he must have used "dadada" for LinkedIn, Twitter and Pinterest? That might imply that "dadada" is either; 1. A password he actually uses on real accounts 2. Its his 'default' throwaway password on places he doesnt really care about. Either way - people (hackers) will try and use "dadada" on any/all other Mark's possible signin on any/all other websites - who knows how many times he repeated this.
  - pen2l 10y ago
    I bet it is his HN password as well! I would go ahead and try but nah, not gonna do it. :)
    - danso 10y ago
      Has it been confirmed that Zuck even browses HN, nevermind have an account? I mean, he's important...but lots of important people have created accounts and posted on HN at some point...Brian Chesky, Drew Houston, Peter Norvig...though the revelation that Alan Kay posts on HN takes the cake http://www.themacro.com/articles/2016/06/hn-highlights-june-4/ http://www.themacro.com/articles/2016/06/hn-highlights-june-...
      - pen2l 10y ago
        He's on HN (pg confirmed this a few years back) but most people don't know his handle. Incidentally, I'm 99% sure I do, but I guess I won't out him.
        _kyran 10y ago
        Without naming the account, what led you to believe that you found it?
        pen2l 10y ago
        About three or four years ago he tried to do an ama but it didn't really take off. Asides the obvious outing himself, there were plenty of other clues confirming him. Also, I'm pretty sure he has more than one handle. By the way, I think most of us realize pg and Mark are on very good terms. Way back, I'm thinking 6'ish years back, Facebook and YC had official connections (YC startups would get access to some of Facebook's tools or some such thing, I don't fully remember. But I think YC reduced the profile of this connection because HN went all up in arms over this back then.
deleted 10y ago
[deleted]
bagels 10y ago
Does this reflect more poorly on Twitter & Pinterest or Mark Zuckerberg in the public eye?
- deleted 10y ago
  [deleted]
- jonknee 10y ago
  Wholly on Zuck for using the same weak password. Password managers are easy, there is no excuse for a tech savvy person to use a bad password (and even worse, re-use the same bad password).
  - everly 10y ago
    You're correct regarding the sentiment on HN but I don't think the general public sees it that way.
    - jonknee 10y ago
      I can't imagine the generally public caring about Zuckerberg's passwords in any capacity at all.
  - brianwawok 10y ago
    For stupid sites who cares? If someone wants my hackernews or reddit passwords, cool. I am not going to go copy paste passwords so my hacker news password is safe.
    - jonknee 10y ago
      To each their own, but in this case if Zuck had used a password manager he wouldn't come out looking like a chump. And honestly it's easier to use one than type even a simple password--one keyboard shortcut and you're automatically logged in.
      - brianwawok 10y ago
laurencei 10y ago
I wonder if this implies a possible insight into password thefts, and why some of the "leaks" take years to actually be distributed/published by the original hacker. If you stole a database of hashed passwords, you could focus on 2-3 "VIP" clients/celebrities of that database, and despite the computational cost, try and crack that hash. Knowning that if/when you crack the hash, you could potentially use that password on other logins that VIP might use, prior to anyone knowing.
sethbannon 10y ago
Is there somewhere to check if one's account / pass was in the database?
- laurencei 10y ago
  https://haveibeenpwned.com/ https://haveibeenpwned.com/ edit: not sure why I was downvoted - this answers the question.
- Cameron_D 10y ago
  https://haveibeenpwned.com/ https://haveibeenpwned.com/
jrnichols 10y ago
What worries me most about this LinkedIn breach is that somehow, some way, they showed my email address. Not once in my life do I recall ever setting up a LinkedIn account. Ever. But somehow, I have one. :/
- itsnotlupus 10y ago
  I think I remember a time where LinkedIn was getting a bit of flack for their practice of "encouraging" new users to share their address books with them, which would mean that, at best, LinkedIn could create "ghost" accounts seeded with relationships and waiting to be claimed, and at worst, sending not-entirely-wanted emails pimping their service to one's entire address book.
- TwoBit 10y ago
  What kind of password did it have for you?
  - jrnichols 10y ago
    I have no idea. I had to go through their password reset hoops to even get in and figure out what was going on and to make sure that it was actually my account. It was, fortunately... or at least one that I had control over. My worry was that someone had made a fake linkedin account.
weakwire 10y ago
Mark Zuckerberg's Twitter and Pinterest Accounts Hacked. Twitter and Pinterest Accounts Hacked. Twitter and Pinterest. Not Facebook. If I was MZ i would use "password" as a password on Twitter and Pinterest...
sbardle 10y ago
Zucks new password: dadada1
stephenr 10y ago
Every time this sort of thing comes up, people piss and moan that password managers are too hard to use/etc. I've never used a password manager besides keychain+safari (across several devices), and I just don't get the issues people claim to have. If third party password managers are so terrible why hasn't chrome/ff/etc got a better built in password manager? Or if they do, why don't people use them?
frgewut 10y ago
"the entire database proved crackable in a mere three days." Is the article claiming that ALL passwords are known now?

63 points by petulla 10y ago

danso 10y ago

FWIW, his password was apparently "dadada". But he basically never used Twitter (didn't follow him on Pinterest), so he probably did what a lot of people do for services they don't really intend on seriously using (except most people seriously use those social media services), which is to just make up a silly password for all of them. Even so, probably should've picked something a little stronger than that...

deleted 10y ago
[deleted]
dawhizkid 10y ago
Optics are really bad here. This is from LinkedIn, so he used a terrible password on at least 3+ large social media websites (and what else?).
- petulla 10y ago
  It is a wonder how no one was worrying about this..
  - 6stringmerc 10y ago
    If I was the underwriter for FB's D&O / Cyber policy about now I'd be making some very uncomfortable phone calls to important people.
- ForHackernews 10y ago
  > at least 3+ large social media websites Three "large" sites that he didn't use or care about. I have a twitter account that I posted one tweet on in 2013. The password is "mystupidpassword" -- have at it, hackers.
  - dawhizkid 10y ago
    You're not Mark Zuckerberg.
    - ForHackernews 10y ago
      Zuckerberg clearly doesn't give a shit about his Pintrest, either.
- exolymph 10y ago
  I have crappy passwords on old accounts that I created before I started using LastPass... but I'm also an irrelevant normal person, not a billionaire CEO at an extremely powerful company. Very silly of Zuck (and really, I should go change my old passwords too).
laurencei 10y ago
But he must have used "dadada" for LinkedIn, Twitter and Pinterest? That might imply that "dadada" is either; 1. A password he actually uses on real accounts 2. Its his 'default' throwaway password on places he doesnt really care about. Either way - people (hackers) will try and use "dadada" on any/all other Mark's possible signin on any/all other websites - who knows how many times he repeated this.
- pen2l 10y ago
  I bet it is his HN password as well! I would go ahead and try but nah, not gonna do it. :)
  - danso 10y ago
    Has it been confirmed that Zuck even browses HN, nevermind have an account? I mean, he's important...but lots of important people have created accounts and posted on HN at some point...Brian Chesky, Drew Houston, Peter Norvig...though the revelation that Alan Kay posts on HN takes the cake http://www.themacro.com/articles/2016/06/hn-highlights-june-4/ http://www.themacro.com/articles/2016/06/hn-highlights-june-...
    - pen2l 10y ago
      He's on HN (pg confirmed this a few years back) but most people don't know his handle. Incidentally, I'm 99% sure I do, but I guess I won't out him.
      - _kyran 10y ago
        Without naming the account, what led you to believe that you found it?
        pen2l 10y ago
        About three or four years ago he tried to do an ama but it didn't really take off. Asides the obvious outing himself, there were plenty of other clues confirming him. Also, I'm pretty sure he has more than one handle. By the way, I think most of us realize pg and Mark are on very good terms. Way back, I'm thinking 6'ish years back, Facebook and YC had official connections (YC startups would get access to some of Facebook's tools or some such thing, I don't fully remember. But I think YC reduced the profile of this connection because HN went all up in arms over this back then.

deleted 10y ago

[deleted]

bagels 10y ago

Does this reflect more poorly on Twitter & Pinterest or Mark Zuckerberg in the public eye?

deleted 10y ago
[deleted]
jonknee 10y ago
Wholly on Zuck for using the same weak password. Password managers are easy, there is no excuse for a tech savvy person to use a bad password (and even worse, re-use the same bad password).
- everly 10y ago
  You're correct regarding the sentiment on HN but I don't think the general public sees it that way.
  - jonknee 10y ago
    I can't imagine the generally public caring about Zuckerberg's passwords in any capacity at all.
- brianwawok 10y ago
  For stupid sites who cares? If someone wants my hackernews or reddit passwords, cool. I am not going to go copy paste passwords so my hacker news password is safe.
  - jonknee 10y ago
    To each their own, but in this case if Zuck had used a password manager he wouldn't come out looking like a chump. And honestly it's easier to use one than type even a simple password--one keyboard shortcut and you're automatically logged in.
    - brianwawok 10y ago

laurencei 10y ago

I wonder if this implies a possible insight into password thefts, and why some of the "leaks" take years to actually be distributed/published by the original hacker. If you stole a database of hashed passwords, you could focus on 2-3 "VIP" clients/celebrities of that database, and despite the computational cost, try and crack that hash. Knowning that if/when you crack the hash, you could potentially use that password on other logins that VIP might use, prior to anyone knowing.

sethbannon 10y ago

Is there somewhere to check if one's account / pass was in the database?

laurencei 10y ago
https://haveibeenpwned.com/ https://haveibeenpwned.com/ edit: not sure why I was downvoted - this answers the question.
Cameron_D 10y ago
https://haveibeenpwned.com/ https://haveibeenpwned.com/

jrnichols 10y ago

What worries me most about this LinkedIn breach is that somehow, some way, they showed my email address. Not once in my life do I recall ever setting up a LinkedIn account. Ever. But somehow, I have one. :/

itsnotlupus 10y ago
I think I remember a time where LinkedIn was getting a bit of flack for their practice of "encouraging" new users to share their address books with them, which would mean that, at best, LinkedIn could create "ghost" accounts seeded with relationships and waiting to be claimed, and at worst, sending not-entirely-wanted emails pimping their service to one's entire address book.
TwoBit 10y ago
What kind of password did it have for you?
- jrnichols 10y ago
  I have no idea. I had to go through their password reset hoops to even get in and figure out what was going on and to make sure that it was actually my account. It was, fortunately... or at least one that I had control over. My worry was that someone had made a fake linkedin account.

weakwire 10y ago

Mark Zuckerberg's Twitter and Pinterest Accounts Hacked. Twitter and Pinterest Accounts Hacked. Twitter and Pinterest. Not Facebook. If I was MZ i would use "password" as a password on Twitter and Pinterest...

sbardle 10y ago

Zucks new password: dadada1

stephenr 10y ago

Every time this sort of thing comes up, people piss and moan that password managers are too hard to use/etc. I've never used a password manager besides keychain+safari (across several devices), and I just don't get the issues people claim to have. If third party password managers are so terrible why hasn't chrome/ff/etc got a better built in password manager? Or if they do, why don't people use them?

frgewut 10y ago

"the entire database proved crackable in a mere three days." Is the article claiming that ALL passwords are known now?