Twitter Hack Details Revealed

Jack Spine writes "Twitter co-founder Biz Stone has confirmed both to ZDNet UK and Wired's Threat Level blog that a dictionary attack was used to hack Twitter. After the hacker distributed details on the Digital Gangster forum, celebrities such as Britney Spears and Barack Obama had their accounts defaced. Wired spoke to the alleged hacker, while ZDNet UK got in contact with someone who had been on the Digital Gangster forum at the time."

Comments

Limit logins without DOS?

[Manip]

This is one of my favourite security conundrums.

How do you limit someone's login attempts to an account without allowing an account to be denial of serviced?

Captcha - hurts young, old, and disabled users. It can also make it hard for normal users if poorly designed (as many are).

IP Limit - Very easy to bypass with a proxy list.

Hard Account Limits - Denial of service

Thus is the problem. How do you limit logins without hurting legitimate users?

Re:Limit logins without DOS?

[Phrogman]

Perhaps even add +x seconds after every attempt, so your first attempt goes through and fails the next one has a delay of 5s and thereafter its incremented. Most users will get their password correct on the second try or perhaps the third, the script will die a slow death.

Comment removed

[account_deleted]

Comment removed based on user account deletion