7 ms·

What I Learned After I Published My Twitter Password

82 points by danielhonigman 12y ago

iLoch 12y ago
I really hate Twitter's TFA approach and have it disabled for security reasons. Primarily, if someone gets access to your cellphone network account (Sprint, ATT, etc.) they can receive texts on your behalf. So if your Twitter password happens to be the same as your ATT password, you're out of luck. I only use two factor authentication if I can add it to my Authenticator app and save the code/QR code somewhere offline. Everything else is just too complex to be secure.
- sehrope 12y ago
  > So if your Twitter password happens to be the same as your ATT password, you're out of luck. Why would you have both passwords be the same? That makes no sense. All passwords should be different. > I only use two factor authentication if I can add it to my Authenticator app and save the code/QR code somewhere offline. Everything else is just too complex to be secure. TOTP based two-factor auth (e.g. Google Authenticator) is my preferred method as well though I'll still set up an alternative method if it's not available. For example Namecheap offers 2FA via SMS. While not preferred, it's better than nothing.
  - dictum 12y ago
    > Why would you have both passwords be the same? That makes no sense. All passwords should be different. I'd put good money on the percentage of AT&T customers who use the same password for all their web services being sizable enough to make that a valid concern.
  - parfe 12y ago
    >Why would you have both passwords be the same? That makes no sense. Sure it does. With only one password you are less likely to forget how to log in to an account. It makes perfect sense. >All passwords should be different. And eat veggies with every meal. And properly hydrate throughout the day. And get 40 minutes of moderate cardio at least three times a week. And call your mother more. And floss daily. You can't expect all the people to follow the "best" advice all the time.
kyle_t 12y ago
I was completely shocked when I read this yesterday morning while drinking my morning coffee. The best outcome that could arise from the author disclosing his password is him receiving hundreds of texts that day. I understand the point he is making, but still a very risky move.
- josu 12y ago
  As long as his Twitter account was isolated[1], the only risk was losing control of his twitter account for a few days. And given the fact that he published an article previously saying that he was going to give away his password, I don't think that he would run into much trouble even if they used his twitter account for malicious purposes. [1]This is, the twitter account wasn't being used to log into other services.
  - tempestn 12y ago
    You assume that losing control of his twitter account couldn't have unforeseen consequences. I'm sure the author didn't expect that he would end up having to change his phone number. It's not at all implausible that there could have been further repercussions.
danso 12y ago
OK, the key newsy takeaway: > But a glaring flaw in Twitter’s account-security system lets anyone who obtains your password learn whatever mobile-phone number you’ve associated with your Twitter account if you turned on a simple but highly effective security measure So...I don't know what the "flaw" is...but it doesn't seem to me that the OP learned the biggest lesson of all about security: that pretty much everything is a tradeoff. Granted, I'm having a hard time thinking why Twitter would feel the need to expose the phone-number at all to a user outside of his/her own account page, so I'm guessing that is some unintended bug. However, consider the situation: The OP gives away his password...Two-factor authentication never, ever meant "hey, it's just as strong as if you give away one of the factors"...I've never designed a security system before, but I'm guessing things would become very convoluted if security designers had to treat giving away your password -- as a public announcement and media figure -- as anything but an edge case. The inconvenience of 2-factor-authentication is meant to offset the problem of total compromise given the relatively frequent chance of getting phished. Twitter's flaw, as described, is likely not a main attack vector for phishers who are sending out thousands and thousands of emails and hoping to get turnkey access to someone's account...even if Twitter gives away the phone-number through some sort of exerted effort...that's unlikely to be the exerted effort used by mass phishers. It's a totally different security game when you're the target of thousands rather than one target among thousands. (that said, Twitter should fix the flaw, unless there's some other dependency on having the phone number be accessible)
- x1798DE 12y ago
  >So...I don't know what the "flaw" is...but it doesn't seem to me that the OP learned the biggest lesson of all about security: that pretty much everything is a tradeoff. The flaw is side-channel data leakage about the authentication process and about the user data - they're revealing private information to someone who has not successfully authenticated. Just because the guy published his password doesn't mean it's not a flaw - if someone got his password from a compromised database they shouldn't be able to leverage that into finding out his phone number or anything else about him, if he's already arranged with Twitter (or any other service) to a protocol which basically says, "Don't believe anyone saying they are me unless they both know my password and have my phone." Frankly, a well-designed 2FA system shouldn't even reveal whether or not you've successfully authenticated using one of the factors. For TOTP this is possible because you can enter in the username, password and TOTP code all at the same time (though it's rare to see this implementation). Even if TOTP is not enabled for most accounts, you'd still want to show the box and say, "Leave this blank if you don't have TOTP enabled". For this SMS-based second-factor, I'm not sure how to design it so that there are no side-channel attacks other than sending an SMS with an authentication token every single time, whether or not the password was entered correctly (which allows random people with your login to just randomly send you authentication spam).
gmjosack 12y ago
The article mentions using Google Authenticator but I'd recommend Duo (Duo Mobile on Android) as it lets you reorganize your accounts, assign icons to various accounts, and only shows the token you care about via expanding with a much larger font. Once I passed around 6 two-factor accounts Google Authenticator became too hard to use.
- tyilo 12y ago
  Have you tried Authy? How does Duo Mobile compare to that?
  - kylequest 12y ago
    Authy is much more complicated to setup compared to Duo. In my TFA app experiments quite a few people had problems with the setup process (failing to complete it in several cases). They were pretty technical people too, which says a lot about Authy's usability...
    - chimeracoder 12y ago
      There are also a lot of security concerns about Authy that were raised a while back. If you read the comments, it doesn't instill a lot of confidence in the team to implement a secure platform of this sort[0]. Unfortunately, security is one of the few areas in which 90% isn't "good enough" - all you need is one point of failure for an entire system to get compromised. [0] https://news.ycombinator.com/item?id=4921684 https://news.ycombinator.com/item?id=4921684
x1798DE 12y ago
I think this is just illustrating precisely the point of two-factor authentication, which is defense in depth. Right now, you have one factor which means that anything that compromises that factor compromises you, and who knows what bizarre attacks someone can land once they've started penetrating your defenses. By publishing your password, you're going back down to a single factor (and in some ways it's worse than that, because who knows what security policies are in place for most services - having half of a two-factor pair here has clearly been interpreted as being someone "more authenticated" than having NONE of a single factor). That said, I would love it if the default single factor authentication method were public keys rather than passwords. I get how impractical that is with people constantly trying to access things in some device-independent way, but I fantasize about a world where everyone carries around a cheap hardware authentication module that just negotiates the cryptographic part of SSL handshakes as the primary authentication factor (with passwords and biometrics as secondary and tertiary factors as desired). Sure would be nice if the only thing that could be leaked after a data breach was your public key.
- rcaught 12y ago
  > a world where everyone carries around a cheap hardware authentication module There are moves towards such a future with U2F / UAF (Fido) and Yubikeys (a U2F version is meant to be released this year). I know it won't roll out exactly as planned, but I'm still excited by the tech.
  - ef4 12y ago
    Yeah, U2F is exciting. It has a lot of weight behind it, and I can't wait to try out the new Yubikey implementation. We move closer to the day when I can buy embedded authentication hardware in the form of a ring, and I can make endless jokes about One Ring to Rule Them All.
- lotsofcows 12y ago
  "a world where everyone carries around a cheap hardware authentication module" You mean you don't have ssh-agent and Google Authenticator on your mobile 'phone?
owenversteeg 12y ago
Good article. In both this and the previous articles, the author seemed to know what he was talking about, gave actual security advice, and ran an interesting experiment.
EA 12y ago
Up until last fall, a hacker could social engineer their way into an AT&T account. OP's Twitter account is only as secure at his cell phone service account.
orbifold 12y ago
I think two factor authentification is just an excuse to confirm your real identity, as it is much harder to obtain a fake phone number compared to a fake email address. I bet internally someone using two factor authentification is seen as more valuable to advertisers, since the phone number can probably be tied to a credit card record and other information collected by banks and other large real world companies. To 95% of twitter users it would probably be completely inconsequential if their account were compromised, just create a new one an let all your friends know.
- oddevan 12y ago
  And to the last 5% that use the "Log in with Twitter" buttons in order to avoid creating another (probably weak) password, 2-factor is invaluable since it protects not just our twitter network but any accounts that it has been linked to.
  - orbifold 12y ago
    Sure if you don't care that Twitter knows all the services you use, then that is fine. It does make little sense to me to use Twitter as your main identity provider.
danielweber 12y ago
ISTR someone building a site out there that let you play with Google Authenticator on your own without messing with your Google account. Did I imagine that?
- sweis 12y ago
  Like this TOTP debugger? https://google-authenticator.googlecode.com/git/libpam/totp.html https://google-authenticator.googlecode.com/git/libpam/totp.... It used to generate a QR code for you to scan, but that's apparently broken.
tabrischen 12y ago
How does SMS based 2FA work when you're overseas? Will you still be able to receive it and will it incur international charges?
- kryptiskt 12y ago
  It should work, but some networks are really bad at delivering messages, dropping them or delaying them by hours. As for charges, that may be a problem. But I have never seen international charges of over a dollar for a simple text. But I haven't been to really exotic locations. I still use SMS for the second factor, it's way less secure, but I have it mostly to protect against opportunistic attacks, and having the second factor bound to a device that I will lose or kill with 100% certainty isn't a great solution for me.
matthiasb 12y ago
My company makes this password manager: http://www.cloudentr.com/ http://www.cloudentr.com/ Give it a try! You can secure all your passwords using your mobile phone as second factor of authentication.
- sweis 12y ago
  I could not find any technical details from Gemalto besides this blurb, which doesn't inspire confidence: "We encrypt your CloudEntr password with a cryptographic hash function – and make sure you’re the only one with the key. We also secure your web logins with AES-256 symmetric key encryption algorithm."
  - matthiasb 12y ago
    sweis, I met with the CloudEntr team to learn more about the technical implementation. They are working on a security page which will provide more details soon. In the meantime, I can share what I learned from them. The CloudEntr password is stored hashed and salted on our servers, it is also used to encrypt and decrypt all the application passwords and notes within our web browser plug-in. I will post the link to the security page once it is published! Thanks for your feedback.
tempestn 12y ago
Lots of good points there, but this seemed a bit odd: "...it’s worth managing your passwords, as inconvenient as that can be." Personally I find it much more convenient to use a password manager than to try to remember what username (or was it an email address?) and password I used for every obscure thing I've ever had to log into. Even if you tried to use the same password for everything, completely ignoring how bad an idea that would be, I think a good password manager would still be more convenient, since there are often restrictions on usernames and passwords that prevent you from using the same thing. (For example, my bank boneheadedly requires an alphanumeric password of exactly 6 characters...)
Scoundreller 12y ago
This may not be the ideal place to ask this but here it goes: What about authenticating a logout? If someone is intercepting your communication, and you logout, how can you be sure that your logout has actually executed? The "You have signed out" page could display a one-time code that should match a second set of seemingly randomly generated codes on your mobile phone.

iLoch 12y ago

I really hate Twitter's TFA approach and have it disabled for security reasons. Primarily, if someone gets access to your cellphone network account (Sprint, ATT, etc.) they can receive texts on your behalf. So if your Twitter password happens to be the same as your ATT password, you're out of luck. I only use two factor authentication if I can add it to my Authenticator app and save the code/QR code somewhere offline. Everything else is just too complex to be secure.

sehrope 12y ago
> So if your Twitter password happens to be the same as your ATT password, you're out of luck. Why would you have both passwords be the same? That makes no sense. All passwords should be different. > I only use two factor authentication if I can add it to my Authenticator app and save the code/QR code somewhere offline. Everything else is just too complex to be secure. TOTP based two-factor auth (e.g. Google Authenticator) is my preferred method as well though I'll still set up an alternative method if it's not available. For example Namecheap offers 2FA via SMS. While not preferred, it's better than nothing.
- dictum 12y ago
  > Why would you have both passwords be the same? That makes no sense. All passwords should be different. I'd put good money on the percentage of AT&T customers who use the same password for all their web services being sizable enough to make that a valid concern.
- parfe 12y ago
  >Why would you have both passwords be the same? That makes no sense. Sure it does. With only one password you are less likely to forget how to log in to an account. It makes perfect sense. >All passwords should be different. And eat veggies with every meal. And properly hydrate throughout the day. And get 40 minutes of moderate cardio at least three times a week. And call your mother more. And floss daily. You can't expect all the people to follow the "best" advice all the time.

kyle_t 12y ago

I was completely shocked when I read this yesterday morning while drinking my morning coffee. The best outcome that could arise from the author disclosing his password is him receiving hundreds of texts that day. I understand the point he is making, but still a very risky move.

josu 12y ago
As long as his Twitter account was isolated[1], the only risk was losing control of his twitter account for a few days. And given the fact that he published an article previously saying that he was going to give away his password, I don't think that he would run into much trouble even if they used his twitter account for malicious purposes. [1]This is, the twitter account wasn't being used to log into other services.
- tempestn 12y ago
  You assume that losing control of his twitter account couldn't have unforeseen consequences. I'm sure the author didn't expect that he would end up having to change his phone number. It's not at all implausible that there could have been further repercussions.

danso 12y ago

OK, the key newsy takeaway: > But a glaring flaw in Twitter’s account-security system lets anyone who obtains your password learn whatever mobile-phone number you’ve associated with your Twitter account if you turned on a simple but highly effective security measure So...I don't know what the "flaw" is...but it doesn't seem to me that the OP learned the biggest lesson of all about security: that pretty much everything is a tradeoff. Granted, I'm having a hard time thinking why Twitter would feel the need to expose the phone-number at all to a user outside of his/her own account page, so I'm guessing that is some unintended bug. However, consider the situation: The OP gives away his password...Two-factor authentication never, ever meant "hey, it's just as strong as if you give away one of the factors"...I've never designed a security system before, but I'm guessing things would become very convoluted if security designers had to treat giving away your password -- as a public announcement and media figure -- as anything but an edge case. The inconvenience of 2-factor-authentication is meant to offset the problem of total compromise given the relatively frequent chance of getting phished. Twitter's flaw, as described, is likely not a main attack vector for phishers who are sending out thousands and thousands of emails and hoping to get turnkey access to someone's account...even if Twitter gives away the phone-number through some sort of exerted effort...that's unlikely to be the exerted effort used by mass phishers. It's a totally different security game when you're the target of thousands rather than one target among thousands. (that said, Twitter should fix the flaw, unless there's some other dependency on having the phone number be accessible)

x1798DE 12y ago
>So...I don't know what the "flaw" is...but it doesn't seem to me that the OP learned the biggest lesson of all about security: that pretty much everything is a tradeoff. The flaw is side-channel data leakage about the authentication process and about the user data - they're revealing private information to someone who has not successfully authenticated. Just because the guy published his password doesn't mean it's not a flaw - if someone got his password from a compromised database they shouldn't be able to leverage that into finding out his phone number or anything else about him, if he's already arranged with Twitter (or any other service) to a protocol which basically says, "Don't believe anyone saying they are me unless they both know my password and have my phone." Frankly, a well-designed 2FA system shouldn't even reveal whether or not you've successfully authenticated using one of the factors. For TOTP this is possible because you can enter in the username, password and TOTP code all at the same time (though it's rare to see this implementation). Even if TOTP is not enabled for most accounts, you'd still want to show the box and say, "Leave this blank if you don't have TOTP enabled". For this SMS-based second-factor, I'm not sure how to design it so that there are no side-channel attacks other than sending an SMS with an authentication token every single time, whether or not the password was entered correctly (which allows random people with your login to just randomly send you authentication spam).

gmjosack 12y ago

The article mentions using Google Authenticator but I'd recommend Duo (Duo Mobile on Android) as it lets you reorganize your accounts, assign icons to various accounts, and only shows the token you care about via expanding with a much larger font. Once I passed around 6 two-factor accounts Google Authenticator became too hard to use.

tyilo 12y ago
Have you tried Authy? How does Duo Mobile compare to that?
- kylequest 12y ago
  Authy is much more complicated to setup compared to Duo. In my TFA app experiments quite a few people had problems with the setup process (failing to complete it in several cases). They were pretty technical people too, which says a lot about Authy's usability...
  - chimeracoder 12y ago
    There are also a lot of security concerns about Authy that were raised a while back. If you read the comments, it doesn't instill a lot of confidence in the team to implement a secure platform of this sort[0]. Unfortunately, security is one of the few areas in which 90% isn't "good enough" - all you need is one point of failure for an entire system to get compromised. [0] https://news.ycombinator.com/item?id=4921684 https://news.ycombinator.com/item?id=4921684

x1798DE 12y ago

I think this is just illustrating precisely the point of two-factor authentication, which is defense in depth. Right now, you have one factor which means that anything that compromises that factor compromises you, and who knows what bizarre attacks someone can land once they've started penetrating your defenses. By publishing your password, you're going back down to a single factor (and in some ways it's worse than that, because who knows what security policies are in place for most services - having half of a two-factor pair here has clearly been interpreted as being someone "more authenticated" than having NONE of a single factor). That said, I would love it if the default single factor authentication method were public keys rather than passwords. I get how impractical that is with people constantly trying to access things in some device-independent way, but I fantasize about a world where everyone carries around a cheap hardware authentication module that just negotiates the cryptographic part of SSL handshakes as the primary authentication factor (with passwords and biometrics as secondary and tertiary factors as desired). Sure would be nice if the only thing that could be leaked after a data breach was your public key.

rcaught 12y ago
> a world where everyone carries around a cheap hardware authentication module There are moves towards such a future with U2F / UAF (Fido) and Yubikeys (a U2F version is meant to be released this year). I know it won't roll out exactly as planned, but I'm still excited by the tech.
- ef4 12y ago
  Yeah, U2F is exciting. It has a lot of weight behind it, and I can't wait to try out the new Yubikey implementation. We move closer to the day when I can buy embedded authentication hardware in the form of a ring, and I can make endless jokes about One Ring to Rule Them All.
lotsofcows 12y ago
"a world where everyone carries around a cheap hardware authentication module" You mean you don't have ssh-agent and Google Authenticator on your mobile 'phone?

owenversteeg 12y ago

Good article. In both this and the previous articles, the author seemed to know what he was talking about, gave actual security advice, and ran an interesting experiment.

EA 12y ago

Up until last fall, a hacker could social engineer their way into an AT&T account. OP's Twitter account is only as secure at his cell phone service account.

orbifold 12y ago

I think two factor authentification is just an excuse to confirm your real identity, as it is much harder to obtain a fake phone number compared to a fake email address. I bet internally someone using two factor authentification is seen as more valuable to advertisers, since the phone number can probably be tied to a credit card record and other information collected by banks and other large real world companies. To 95% of twitter users it would probably be completely inconsequential if their account were compromised, just create a new one an let all your friends know.

oddevan 12y ago
And to the last 5% that use the "Log in with Twitter" buttons in order to avoid creating another (probably weak) password, 2-factor is invaluable since it protects not just our twitter network but any accounts that it has been linked to.
- orbifold 12y ago
  Sure if you don't care that Twitter knows all the services you use, then that is fine. It does make little sense to me to use Twitter as your main identity provider.

danielweber 12y ago

ISTR someone building a site out there that let you play with Google Authenticator on your own without messing with your Google account. Did I imagine that?

sweis 12y ago
Like this TOTP debugger? https://google-authenticator.googlecode.com/git/libpam/totp.html https://google-authenticator.googlecode.com/git/libpam/totp.... It used to generate a QR code for you to scan, but that's apparently broken.

tabrischen 12y ago

How does SMS based 2FA work when you're overseas? Will you still be able to receive it and will it incur international charges?

kryptiskt 12y ago
It should work, but some networks are really bad at delivering messages, dropping them or delaying them by hours. As for charges, that may be a problem. But I have never seen international charges of over a dollar for a simple text. But I haven't been to really exotic locations. I still use SMS for the second factor, it's way less secure, but I have it mostly to protect against opportunistic attacks, and having the second factor bound to a device that I will lose or kill with 100% certainty isn't a great solution for me.

matthiasb 12y ago

My company makes this password manager: http://www.cloudentr.com/ http://www.cloudentr.com/ Give it a try! You can secure all your passwords using your mobile phone as second factor of authentication.

sweis 12y ago
I could not find any technical details from Gemalto besides this blurb, which doesn't inspire confidence: "We encrypt your CloudEntr password with a cryptographic hash function – and make sure you’re the only one with the key. We also secure your web logins with AES-256 symmetric key encryption algorithm."
- matthiasb 12y ago
  sweis, I met with the CloudEntr team to learn more about the technical implementation. They are working on a security page which will provide more details soon. In the meantime, I can share what I learned from them. The CloudEntr password is stored hashed and salted on our servers, it is also used to encrypt and decrypt all the application passwords and notes within our web browser plug-in. I will post the link to the security page once it is published! Thanks for your feedback.

tempestn 12y ago

Lots of good points there, but this seemed a bit odd: "...it’s worth managing your passwords, as inconvenient as that can be." Personally I find it much more convenient to use a password manager than to try to remember what username (or was it an email address?) and password I used for every obscure thing I've ever had to log into. Even if you tried to use the same password for everything, completely ignoring how bad an idea that would be, I think a good password manager would still be more convenient, since there are often restrictions on usernames and passwords that prevent you from using the same thing. (For example, my bank boneheadedly requires an alphanumeric password of exactly 6 characters...)

Scoundreller 12y ago

This may not be the ideal place to ask this but here it goes: What about authenticating a logout? If someone is intercepting your communication, and you logout, how can you be sure that your logout has actually executed? The "You have signed out" page could display a one-time code that should match a second set of seemingly randomly generated codes on your mobile phone.