7 ms·
Trump's Twitter account hacked after Dutch researcher guessed password?
- taytus 6y agoThe password was maga2020 infinite_facepalm.gif
- badcircle 6y agoYou forgot the special character for extra security. it was maga2020!
- tinodotim 6y ago* maga2020!
- justusthane 6y agoIt's got everything a strong password needs. Letters, numbers, and special characters!
- makerofspoons 6y agoWith such a simple password, how many people have been in there monitoring direct messages and the president's activities on the platform? This is unbelievable.
- SwiftyBug 6y agoOff topic: how do you format text on Hacker News? I never knew it was possible to use italics.
- justusthane 6y agohttps://news.ycombinator.com/formatdoc https://news.ycombinator.com/formatdoc
- deleted 6y ago[deleted]
- deleted 6y ago[deleted]
- orthecreedence 6y agoIt's kind of a tiny subset of markdown. So you can surround words/phrases in * to italicize. Maybe indent four spaces for(code blocks) { ... } Yep, that worked.
- ganoushoreilly 6y agoThere's no evidence in this story, I'd take it with a grain of salt.
- dmode 6y agoAgreed. If the password was that simple it would have hacked a while back
- aaronbrethorst 6y agoTwo economists were walking down the street. The first one says: “Isn’t that a $20 bill?” The second one says: “Can’t be. If it were, somebody would have picked it up already.”
- monoideism 6y agoI agree. I'm very skeptical that twitter doesn't have some special safeguards in place, nevermind Trump.
- polytely 6y agoI mean who knows how many intelligence agencies are reading his DM's. If I knew Trumps password I wouldn't do anything that would make it clear that I knew it.
- im3w1l 6y ago
- gauravphoenix 6y agowait, really? there is no two factor auth on his account? Actually, someone observed that while he was debating last time with Biden his account was tweeting. So it is sort of make sense - the password is likely shared which makes two factor auth hard.
- st1x7 6y agoThere is now.
- ralphm 6y agoIn this Dutch article (https://www.rtlnieuws.nl/nieuws/buitenland/artikel/5191916/donald-trump-twitter-gehackt-nederlandse-hacker-victor-gevers https://www.rtlnieuws.nl/nieuws/buitenland/artikel/5191916/d...) it is suggested that they didn't use two-step verification because it would be cumbersome for his campaign team. Whether or not this is true, Twitter definitely needs to start having multi-user functionality. Beyond TweetDeck Teams.
- runeb 6y agoSharing 2FA is easy with a password manager, if you have the option of Authenticator app
- colmvp 6y agoI can't tell if this is the Onion or not
- tompccs 6y agoSorry, I just can't believe that the first person to guess Trump's (surely the most valuable target in the world for hackers) password as 'maga2020' would be a white hat. This looks like a hoax to me.
- moritonal 6y agoOr, he's both the first who's brave enough to try, and honest enough to admit it.
- AdmiralAsshat 6y ago> Gevers said the ease with which he accessed Trump’s account suggested the president was not using basic security measures like two-step verification. I am gobsmacked that Twitter allowed his account to continue without some kind of additional security measures like 2FA or geo-IP checking. This is a guy that could literally start World War III by sending a tweet like, "Eat shit, China! Missiles on their way!" And Twitter didn't think it should be locked down beyond a simple password!?!
- darepublic 6y agolets integrate the nukes with twitter and IFTTT.
- deleted 6y ago[deleted]
- creaturemachine 6y agoWhat are they going to do, kick him off? This man's account has been the singular reason for Twitter's relevance over the past four years.
- AdmiralAsshat 6y ago2FA would be ideal, but GeoIP restriction requires no action on the part of the end-user. If implemented properly, Twitter should have been alerted that something was fishy when an IP from the Netherlands sent a successful login password and prevented it, then e-mailed the user to ask if the login attempt was legitimate. It saved my butt once when Gmail prevented an IP originating in India from logging into my account and alerted me.
- varbhat 6y agoIMO anyone using internet must be taught about Passwords and how non guessable strong password can prevent(to some extent) these kind of attacks (cracking the account).
- pps43 6y agoLet's see: * Letters - check * Numbers - check * Special symbols - check So the new, secure, password should be Maga2020!
- zalkota 6y agoDelete this garbage
- flog 6y agoIsn't this enough of a crime for some prison time? Is there some exception for registered researchers or something?
- robbyking 6y agoThat was my first thought, too. The student who "hacked" Sarah Palin's email account (he reset her password by answering her security questions using publicly available information) was convicted of a felony and spent a year and a day in jail.
- henryfjordan 6y agoIf all you intend to do is get in, nothing else, then it is probably not a crime. The CFAA prohibits "knowingly and with intent to defraud, accesses a protected computer without authorization". There's also a clause about not accessing govt computers (but this was Twitter's server) and not forwarding any secrets you find. All this guy did was get in and then called the authorities, so he probably didn't 'intend to defraud'. If he tweeted something, which he alludes to in some articles, that might be a felony. IANAL, get a lawyer if you are into hacking
- icpmacdo 6y agoI honestly find it difficult to believe his password was maga2020!
- raziel2p 6y agowhy do you find it difficult?
- buzzwordninja 6y agoIt's like having 12345 as the code on your luggage.
- valvar 6y agoTo be fair, there's really very little point to having a code for your luggage. The amount of added security it gives is laughable.
- crowbahr 6y agoIt's basically just there to dissuade casual pickpocket/theft. Like if you're traveling by rail and have your briefcase overhead and are snoozing, someone could just open it, take your laptop and disappear. That's about the sum total of cases it's preventing. Not terribly useful, no.
- darepublic 6y agoThe password format <word><number><special char> is surely the most common password pattern that everyone seems to have independently adopted
- goshx 6y agoIf you haven't, you need to watch this: https://www.youtube.com/watch?v=aHaBH4LqGsI https://www.youtube.com/watch?v=aHaBH4LqGsI edit: title is "You Should Probably Change Your Password! | Michael McIntyre Netflix Special" if you prefer to search on youtube yourself
- CydeWeys 6y agoIt's not happening independently, it's cargo-culted. There's lots of "security advice" out there recommending doing exactly this. Plus, if you're missing a requirement when trying to set your password, the easiest thing to do is just append the missing requirement at the end. Especially if it's punctuation, which naturally goes at the end of words/sentences anyway.
- qppo 6y agoI've taken to using random passwords for signup and password reset for each login, since that's what password guidelines eventually force me to do anyway.
- CydeWeys 6y agoOne of my huge pet peeves is when sites have really idiosyncratic password requirements, like they require the use of at least 1 punctuation characters (but it's from a limited subset of available punctuation characters), or uncommon requirements on length (I've seen both can't be longer than 10 characters and must be longer than 12). And yet, none of these requirements are visible on the login page! So I have no freaking clue what my password might actually be, and thus my typical login flow for these lesser used accounts is always going through the password reset flow. It's a joke.
- hawkoy 6y ago
- DLay 6y agoTwitter spokesperson Ian Plunkett: “We’ve seen no evidence to corroborate this claim, including from the article published in the Netherlands today. We proactively implemented account security measures for a designated group of high-profile, election-related Twitter accounts in the United States, including federal branches of government.” https://techcrunch.com/2020/10/22/dutch-hacker-trump-twitter-account-password/ https://techcrunch.com/2020/10/22/dutch-hacker-trump-twitter...
- lostlogin 6y agoProactively? Was that after the other massive hack or after this one?
- TwoBit 6y agoThis doesn't make sense to me. Twitter has the IP addresses of all logins, so they absolutely know whether this happened or not. "we've seen no evidence..." is a senseless thing to say and implies they are being evasive about something.
- class4behavior 6y agoYou're the one not making sense. "We've seen no evidence..." clearly implies they haven't logged any successful login after multiple attempts from a foreign IP or the Netherlands specifically as described, plus their other measures weren't triggered either.
- nrmitchi 6y agoThe Trump-tie aside, does anyone have a good reason why 2FA isn't absolutely enforced on all verified accounts? I can't really see a situation where the need for "authenticity" of a person/account meets the bar for needing verification, but not be considered important enough for basic security practices.
- sbarre 6y agoA somewhat educated guess: Probably the "cost-to-serve" metrics that Twitter considers when making these changes. Force 2FA on your most high-profile customers, and your support costs skyrocket as a steady stream of these customers who didn't want this new and (relatively) complicated measure forget or lose their 2FA setup, and you find yourself constantly resetting it or changing it, which probably in the long term reduces the effectiveness of it since it becomes a routine for your support operation and it's easier for bad actors to fake it.
- input_sh 6y agoI've stumbled upon enough verified accounts that had their display name and photos changed to Elon Musk's and pretended to give away Bitcoins that I believe it's a worthy sacrifice to make.
- sbarre 6y agoYou and me both, but Twitter is a public company with fiduciary responsibilities to shareholders above all else (including the public good), so here we are. Until these kinds of problems affect their brand enough to cause financial harm, don't hold your breath for higher security and accountability measures by default.
- bostik 6y agoI can guess. People lose or break their phones often enough. It is a routine thing in an organisation of just 120 people. Now imagine that instead of an educated and selective group, you are dealing with a pool of desperately partying, drunk globetrotting influencers, political figures with Neanderthal technical skills or other walking security disasters. How often do you think account recovery due to lost 2FA would be triggered? For proper protection you need hardware 2FA, and for usability reasons you really need the NFC enabled Yubikey so the same second factor can be neatly enforced on a mobile phone too. But you can't have just one. If the access is for anything non-trivial or of high importance, you need at least two such devices. Preferably three. That's a lot of Yubikeys you need to subsidise, because most people sure as hell are not buying them out of their own pocket.
- leifg 6y agoThis seems to be completely implausible. Whatever email is tied to this account would have been instantly notified about a "suspicious login". There is absolutely no evidence in the article (not even links or screenshots of his tweet reaching out to the White House). Furthermore I can't believe Trump's account is even going through regular authentication mechanisms. It should be trivial to restrict access to an account to certain address ranges of a government VPN.
- tintor 6y agoThat is what likely happened: "A day after he gained access, Gevers noticed that two-step verification had been activated on Trump’s account. Two days later, the Secret Service got in touch. According to De Volkskrant, they thanked him for bringing the security problem to their attention."
- hyperpape 6y agoI agree with the overall thrust of the questions. But Trump might not cooperate with anything that makes life more inconvenient for him: https://www.cnn.com/2019/12/06/politics/donald-trump-secure-phone-calls-impeachment/index.html https://www.cnn.com/2019/12/06/politics/donald-trump-secure-....
- rhplus 6y agoThere's been repeated claims that Trump has - up until recently - used personal Android and iPhone devices to make calls and tweet. Not clear if that's true or not. https://www.politico.com/story/2018/05/21/trump-phone-security-risk-hackers-601903 https://www.politico.com/story/2018/05/21/trump-phone-securi...
- ccktlmazeltov 6y agoThis is hilarious
- gherkinnn 6y agoI would not know what to do with this power had it been me guessing the password. Another “covfefe” perhaps? An innocent “ALL CAPS DAY” maybe? Or just a simple “;)”? And these are harmless examples. A targeted reference to certain prophets or Winnie the Pooh would have vast consequences. I could have set the world alight for laughs. And to think no extra measures were put in place by Twitter is shocking.
- stabbles 6y agoThe article doesn't mention the password has been changed. I can only imagine millions of people will attempt to login now.
- ufmace 6y agoRegardless of whether this is real or not, it sounds like it's long past time that Twitter implemented proper user controls for the use-case of multiple securely-authorized users who have the ability to control one high-visibility Verified account. Sharing passwords and TOTP creds between a dozen or so actual people seems massively failure-prone.
- memsom 6y agoSomewhere in a Sam Esmail alternate reality, Elliot Alderson is probably smiling or something.
- altmind 6y agoAs the "great hack" is destroying my trust in bloomberg, this article is destroying my trust in the guardian. There's no chance the password was "maga2020!"
- the137 6y agoI wouldn't have trusted bloomberg either way, but the guardian deserves respect. There was a spectacular chance that his password was maga2020 I'll never understand how some of the brightest minds of our generation can end up following this guy. I understand we're seeing confirmation bias => brainwashing en mass, but people on this site should be smart enough to break out of the cycle
- rsynnott 6y agoThis is the same guy who wandered around, maskless, unnecessarily having close personal contact with people, during a pandemic, and ended up in hospital on experimental drugs. Why would you assume he’d take security precautions?
- rv-de 6y agoI was so certain that Twitter handles his account with special attention and some bells and whistles like IP white-/blacklisting etc. It seems like neither Twitter cared about his account's safety nor the secret service. What ... the ... fuck.
- s9w 6y agoCompletely made up. Three submissions, ~50, ~100 and ~150 points in HN. Everyone having a laugh, no one cares for site rules. No moderation in sight. Everyone knows it's fake, no one cares. Rinse and repeat about three times a day over four years. Some of them make it into HN, each one makes in into the minds of thousands. But dare to defend truth and the cavalry is there in seconds.
- codysan 6y agoPretty bold statement coming from someone with a post history as dubious as yours. There's actually some healthy skepticism in this thread and rational conjecture, which I assume you won't be taking part in.
- s9w 6y agoI would be banned for saying that. But go ahead, shots are free against the right people.
- NovaS1X 6y agoDo you have proof this is fake or is that just an assumption?
- TwoBit 6y agoWhat if somebody logged in from a public computer while disguised and with no phone on themselves to trace etc and messed with Trump's account? Could he be identified by any means?
- Mhannah 6y agoDo you need the best hacker with 100% record and transparency, They can help you spy on your spouse, They are also expert in phone hacks, text messages hacks and also he is competent in grade upgrade or any kind of hack. Contact hotcyberlord425 at gmail dot com and a trial will convince you for sure . I'm also convinced. Thanks Text or whatsapp on +1 302 265 0426