8 ms·
Mark Zuckerberg's multi-account password was 'dadada'
- IIAOPSW 10y agoto which I say "hahaha" In all seriousness, many people choose shit passwords for the accounts they don't care about. I'm sure Mark's password for his admin account on fb is probably harder to guess.
- artofcode 10y agodadada1
- colejohnson66 10y agoWhich raises the entropy from 2^6 (64) to 3^7 (2187)! An increase by over 3000%! So much more secure!
- frou_dh 10y ago> many people choose shit passwords for the accounts they don't care about Surely any account tied to your real name / identity is something worth caring about. Doesn't matter how crappy/uninteresting the site is (or becomes), you still don't want to make it easy for someone to take over the account and be impersonating you.
- detaro 10y agohttps://news.ycombinator.com/item?id=11842635 https://news.ycombinator.com/item?id=11842635
- kriro 10y agoThat'll be an excellent example on many security talk slides in the future (PW strength, reuse of PWs, salting) They probably could have made some money by combining some day trading of FB stock with a well timed announcement of resignation due to health concerns or something. Announce, anticipate drop, buy...leak it was fake, sell. Or whatever else you can come up with with some thinking. [maybe not because he'd post that on FB]
- deanCommie 10y agoI don't understand your logic. "If you're going to trespass on someone's property you might as well deface it and steal some of their stuff" I am not a lawyer but I could see password breaching in the interest of white hat security could be is looked an a lot differently by the courts than what you're suggesting
- kriro 10y agoI believe the passwords came from the 2012 LinkedIn breach and was referring to the original criminals. If you have the criminal energy to steal that data you might as well use it. I don't think there was anything white hat about that incident.
- toyg 10y ago> If you have the criminal energy to steal that data you might as well use it. No no no. Any self-respecting criminal will not gain directly from a break-in, but rather sell the goods on to someone with a credible laundering story (or at least someone who will put further space between him and the goods).
- jacquesm 10y ago> Any self-respecting criminal will not gain directly from a break-in, but rather sell the goods on to someone with a credible laundering story I think that contains a contradiction.
- toyg 10y agook, "will not gain from directly leveraging goods acquired in a break-in against the same victims of such break-in". Thieves usually don't try to sell your TV back to you, and the ones who do are widely mocked. But you know what I meant.
- jacquesm 10y agoSounds like an excellent way to spend some time in jail.
- mvdwoord 10y ago“No Facebook systems or accounts were accessed… The affected accounts have been re-secured.” Sounds to me like they weren't very secure to begin with. So they would be "secured" now, not "re-secured". It's crap like this that makes me miss George Carlin.
- Puts 10y agoI'm waiting for the dadada t-shirt. :D
- lfh2omgomg 10y agoRelevant: https://www.youtube.com/watch?v=lNYcviXK4rg https://www.youtube.com/watch?v=lNYcviXK4rg
- frgewut 10y agoHere you go http://www.zazzle.com/dadada_tee_shirt-235801669209689823 http://www.zazzle.com/dadada_tee_shirt-235801669209689823
- scandox 10y ago"...though at $50 a claimant, no-one stood to be much enriched out of the settlement..." The lawyers must find that mildly amusing.
- junto 10y agoHow do I go about claiming my $50?
- jasonlfunk 10y agoYou file the claim form and submit it before May of last year... But you also had to have paid for LinkedIn premium for to be eligible. Source: www.linkedinclassactionsettlement.com
- augustt 10y agoMakes me wonder how securely passwords were stored when he first opened Facebook to colleges.
- D81Q3KJE81 10y agoEveryone who works at Facebook should watch out right now. Endgame Systems (CIA) is trying to hack profiles right not to terrorize people. This is only the beginning.
- satai 10y agoMemes are coming...
- PunchTornado 10y agoI am using that password for dummy accounts (internal) all the time. As an Eastern European it means something in the language (yes). What does it mean in English?
- back_beyond 10y agoI am not aware of any meaning in English
- fit2rule 10y agoWas ist los mit dir, mein Schatz? https://www.youtube.com/watch?v=lNYcviXK4rg https://www.youtube.com/watch?v=lNYcviXK4rg
- takno 10y agoIt's what pre-verbal toddlers tend to call their male parent in the UK. They'd often stop at just dada, but everybody knows 4 character passwords are insecure
- spacemanmatt 10y agoIch lieb dich nicht, du liebst mich nicht. Da da da! (am I the only one who remembers Trio of their song that VW used in ads a few years ago?)
- Keyframe 10y agoDon't know about the ad, but I remember the 80's.
- cha5m 10y agoAnd see here I was about to go and change all my passwords...
- adzm 10y agoAll I can think of is that song... Ich lieb' dich nicht, du liebst mich nicht. Da da da.
- stefanix 10y agorelevant https://www.youtube.com/watch?v=lNYcviXK4rg https://www.youtube.com/watch?v=lNYcviXK4rg
- amelius 10y agoHow is that possible? Many systems require at least 1 digit, and/or at least an uppercase character.
- mlvljr 10y agoAnyone tried his TeamViewer with that passw yet?
- phyzome 10y agoI had no idea he was into avant-garde art! (https://en.wikipedia.org/wiki/Dada https://en.wikipedia.org/wiki/Dada)
- roberthahn 10y agoAs soon as I saw the password I wondered if Mark was left-handed. Turns out I was spot on: a bit of googling revealed he was.
- tjoff 10y agoWhy? A password as simple as dadada has the great advantage that one can write it quickly with one hand - and for this you typically choose a password that you can write with your other hand on the mouse for when you are using it.
- jobigoud 10y agoBut you can access more than 20 keys with your left hand, including numbers and special characters, it's no excuse.
- arcanus 10y agoI'm a southpaw myself, and therefore quite biased, but I've always been struck by the prevalence of CEOs, Presidents, notable scientists, etc. that I have met who are fellow lefties. Don't have a p-value, but it seems much higher than the ambient (~10%) rate. For instance, for the last 4-5 years in our computational science research group, we have been sitting pretty steadily near 50%.
- rjsw 10y agoAt my PPOE it was 50% too. I can remember being in meetings where everyone except one PHB was left handed.
- qrendel 10y agoSelection bias? There are some studies indicating left-handed children tend to score lower (on average) on IQ, verbal scores, etc: http://www.ncbi.nlm.nih.gov/pubmed/16643966 http://www.ncbi.nlm.nih.gov/pubmed/16643966 (Edit: Seems the IQ difference varies between studies and is negligible, if even exists.) Hypothesis is that left-handedness can be caused by early brain trauma, so if "lefties" are disproportionately represented in such positions, the ones with non-pathological causes would seem to have an even bigger advantage over the right-handed to make up for the lower mean. Or perhaps it's associated with other talents that make up for the deficits. (Edit: Wikipedia seems to support this - https://en.wikipedia.org/wiki/Handedness#Intelligence https://en.wikipedia.org/wiki/Handedness#Intelligence) Or perhaps the research conclusions are just wrong.
- frade33 10y agostill better than me ... abc123
- massysett 10y agoAs long as we have way too many unnecessary passwords, this will happen. Merchants have figured this out. Many now allow purchases without creating an account (no doubt also because if people have to create another password, some will just abandon the purchase.) I was reading about the Eero router. They figured this out. They get the user's phone number and send a token by text. Passwords are horrible for usage and horrible for security. Just horrible all around.
- hackim 10y agohaha easy to remember..
- sakri 10y agoSo the combination is... da, da, da? That's the stupidest combination I've ever heard in my life! That's the kind of thing an idiot would have on his luggage!
- jasonellis 10y agoda, da, da? That's amazing! I've got the same combination on my luggage!
- lfowles 10y agoAn infant could have come up with that combination!
- d3ckard 10y agoWell... https://www.youtube.com/watch?v=L7abNYC0KQI https://www.youtube.com/watch?v=L7abNYC0KQI
- lfottaviano 10y agoI think he was paying to someone else to manage his media.
- patrickmay 10y agoDaddy issues?
- Sami_Lehtinen 10y agoSince when has SHA1 been crackable in three days? AFAIK with proper passwords SHA1 is nearly impossible to crack. Did I get something wrong? Salting does make the process slower with bad passwords, but with good ones there's very little difference. Just my gut feeling.
- deleted 10y ago[deleted]
- gravypod 10y agoIt seems like it's easy to find collisions from the hash. https://www.schneier.com/blog/archives/2005/02/sha1_broken.html https://www.schneier.com/blog/archives/2005/02/sha1_broken.h...
- Sami_Lehtinen 10y agoBut in case of passwords, the input masking (limited character set, length etc) makes most of found collisions nonviable? Because can't just freely enter colliding bits for the algorithm.
- heimatau 10y agoYes, here is more info on SHA1 being broken. https://crypto.stackexchange.com/questions/3690/no-sha-1-collision-yet-sha-1-is-broken https://crypto.stackexchange.com/questions/3690/no-sha-1-col...
- deadowl 10y agoThere's nothing to stop anyone from creating a reverse lookup table by systematically generating strings and their hash, and aside from dictionary words, this is an example of low hanging fruit. It's a repeated sequence of characters, which would be the second most obvious heuristic (after the dictionary) when trying to generate plausible passwords and their associated SHA1 hash. Before the LinkedIn leak, I was guilty of sharing passwords across sites, and I got a wake up call by a "someone tried resetting your password" email. Started resetting them all, got to the point where I noticed there were a lot and I should probably use a password manager. Eventually I found out I had over 100 online accounts for various things, all of them now having unique passwords. I've deleted a handful of them (e.g. MySpace, MyCokeRewards). There are a couple more I'm trying to get deleted (e.g. Dominos) but haven't been successful yet.
- l1feh4ck 10y agoIts kinda hard to believe that he used "dadada" as a password. Anyone who have a bit of understanding about how passwords are cracked would never use such a sloppy password. And he had one password for all the social accounts? Ew... How could he be so stupid?
- CGamesPlay 10y agoMark Zuckerberg doesn't care about his Pinterest and Twitter accounts. He created them to scope out the competition and doesn't care if they get compromised. That's why his Instagram didn't get affected; he does care about that one (or at least somebody on the team of people he employs to protect the security of his websites does). Now, I'll bet the lesson Zuck takes away from this is actually that other people care more about his Pinterest than he does (e.g. If John Doe sees Zuck pin something John may be much more likely to check that product out).
- takno 10y agoSo the takeaway is to use a fake name as well
- zerooneinfinity 10y agoMaybe ahahah is another password - https://www.youtube.com/watch?v=lNYcviXK4rg https://www.youtube.com/watch?v=lNYcviXK4rg