4 ms·

Since they have the salts, they could just take a common passwords list, generate the hashes associated with all of them, then force any users with matching has

Since they have the salts, they could just take a common passwords list, generate the hashes associated with all of them, then force any users with matching hashes to change their passwords.

overcast 8y ago
You're misunderstanding how this would work. This is effectively what a hacker would do brute force. You have to generate a hash for each password in your common list, for EACH salt in your user list. 326 million Twitter users x each password in your list. Really comes down to which hashing function they chose, and how fast it does that calculation. Something like bcrypt is roughly 100ms per hash, which is a LONG time when you're crunching billions of them.
- llukas 8y ago
  For 10k passwords and 100ms per hash it is 90 hours of single threaded execution time. There is no excuse not to do it, especially you need to do it only once per user (until password change).
  - giancarlostoro 8y ago
    As somebody else commented, a quicker solution is to just force a password reset based on number of months since last login. If you havent logged in for over a year is a good rule of thumb.
    - overcast 8y ago
      Right, but I was replying to OP. "Twitter should probably scan their user passwords for obvious / most-used ones and require their users to change their passwords."
  - kgermino 8y ago
    >For 10k passwords and 100ms per hash it is 90 hours of single threaded execution time. That's 90 hours per account, multiply that by 326 million accounts and it's over a billion CPU days. You can reduce it a lot (no need to spend time calculating the password for users who log in regularly, just wait for them to give it to you) but it's still a massive scale. Especially since the biggest risk comes from the millions of rarely used accounts.
    - llukas 8y ago
      Correct. Forgot to multiply by 10^6
  - justsomedood 8y ago
    I'm getting 90 million hours of single threaded execution time for 326 million users with 10k passwords each, and 100ms per hash.
- dasil003 8y ago
  Do it lazily at auth time and use some recency and/or fingerprint heuristic to force either immediate block or password reset through email.

Since they have the salts, they could just take a common passwords list, generate the hashes associated with all of them, then force any users with matching hashes to change their passwords.

overcast 8y ago

You're misunderstanding how this would work. This is effectively what a hacker would do brute force. You have to generate a hash for each password in your common list, for EACH salt in your user list. 326 million Twitter users x each password in your list. Really comes down to which hashing function they chose, and how fast it does that calculation. Something like bcrypt is roughly 100ms per hash, which is a LONG time when you're crunching billions of them.

llukas 8y ago
For 10k passwords and 100ms per hash it is 90 hours of single threaded execution time. There is no excuse not to do it, especially you need to do it only once per user (until password change).
- giancarlostoro 8y ago
  As somebody else commented, a quicker solution is to just force a password reset based on number of months since last login. If you havent logged in for over a year is a good rule of thumb.
  - overcast 8y ago
    Right, but I was replying to OP. "Twitter should probably scan their user passwords for obvious / most-used ones and require their users to change their passwords."
- kgermino 8y ago
  >For 10k passwords and 100ms per hash it is 90 hours of single threaded execution time. That's 90 hours per account, multiply that by 326 million accounts and it's over a billion CPU days. You can reduce it a lot (no need to spend time calculating the password for users who log in regularly, just wait for them to give it to you) but it's still a massive scale. Especially since the biggest risk comes from the millions of rarely used accounts.
  - llukas 8y ago
    Correct. Forgot to multiply by 10^6
- justsomedood 8y ago
  I'm getting 90 million hours of single threaded execution time for 326 million users with 10k passwords each, and 100ms per hash.
dasil003 8y ago
Do it lazily at auth time and use some recency and/or fingerprint heuristic to force either immediate block or password reset through email.