Bob - Garden is Life
A
thread 1/13
This is a subspout on the "password information" that was compromised in the Spoutible security event. There is so much confusion about this and it's something I know a lot about. I'm not associated with the actual people working on Spoutible in any way, so any errors in this are mine alone.
03:50 PM - Feb 05, 2024
Avatar Avatar Avatar
0
10
94
Bob - Garden is Life
A
thread 2/13
When @cbouzy says password hashes were exposed, but not decrypted passwords, here's what that means. Nobody knows your password from the leak. Nobody. They can use sophisticated methods to try to figure it out, but that is going to require a bunch of time and compute horsepower and they may still
03:50 PM - Feb 05, 2024
0
36
Bob - Garden is Life
A
thread 3/13
not get there depending on the quality of your initial password. This is why it's a good idea to change your password and implement 2FA, but nobody is going down the list and logging into accounts. They did get hash values for our passwords. What are those?
03:50 PM - Feb 05, 2024
0
32
Bob - Garden is Life
A
thread 4/13
I'm probably best off using an analogy here. Let's say you want to have a 'tag' that identifies some unique characteristics of the contents of a book. You can use this to ask if, at a glance, it is highly likely that the contents of two books are identical. A simple way to do this is to go through
03:50 PM - Feb 05, 2024
0
25
Bob - Garden is Life
A
thread 5/13
and count the number of times each letter appears. Let's say 'A' appears 1,233,781 times, 'B' 370,466 times, and so on. You end up with a simple table of 26 letter counts. If you look at the same results for another book and it matches on every letter count, you have a pretty high confidence that
03:50 PM - Feb 05, 2024
0
25
Bob - Garden is Life
A
thread 6/13
they are the same book. This is very similar conceptually in how password hashes work, but the algorithms are more sophisticated such that it is impossible to back out the original password from its hash. It's computer math. By having a sufficiently sophisticated hashing algorithm, your password is
03:50 PM - Feb 05, 2024
0
26
Bob - Garden is Life
A
thread 7/13
hashed to a stored value. When you log in, your password is hashed to see if it matches the stored value. This is how password security is done without keeping your actual password stored. The odds of two passwords hashing to the same value are so vanishingly low, that we just say if you hit the
03:51 PM - Feb 05, 2024 (Edited)
0
33
Bob - Garden is Life
A
thread 8/13
hash value, you've entered the right password.

I hope this helps folks understand why there is urgency to change your password, but it does not require panic. If you use the same password on other platforms, you may want to change those as well because somebody may eventually figure out your
03:53 PM - Feb 05, 2024
1
32
Bob - Garden is Life
A
thread 9/13
password and then try it on other sites.

/fin
03:53 PM - Feb 05, 2024
0
26
Bob - Garden is Life
A
thread 10/13
ADDENDUM: I can't help myself. How does the hacker try to figure out your password? They first have to figure out the hashing algorithm used. If it's a standard one, that doesn't take too much time. Then they have to make a guess, run it through the algo, and see if it matches. Then another, and
04:07 PM - Feb 05, 2024
0
18
Bob - Garden is Life
A
thread 11/13
another. If you've got a long enough and sophisticated enough password, the required 'guesses' can run into many trillions or femtillions of combinations. All of a sudden it's beyond the ability of even modern computers to crack and not worth it. This, by the way, is the
04:09 PM - Feb 05, 2024
0
17
Bob - Garden is Life
A
thread 12/13
very explanation for why sites want difficult to guess passwords with symbols, numbers, and upper case characters. It increases the search space for brute force password cracking. Ultimately, many or even most of our passwords will go uncracked because it's so difficult, but we can't assume that.
04:10 PM - Feb 05, 2024
0
22
Bob - Garden is Life
A
thread 13/13
@michiru posted this and it's a perfect visualization of the power of sophisticated passwords. Also, the reason you're told to never use names or birthdays is because a hacker that knows that info can take a password from unbreakable to cracked if you use that info somewhere in the password.
04:50 PM - Feb 05, 2024
1
15
Just Judith'n'ALF #VotedYes
A
In response to Bob - Garden is Life.
Thank you. I like learning this stuff.
And I need to too.
09:30 PM - Feb 05, 2024
0
6
Liz
A
In response to Bob - Garden is Life.
Thank you Bob
07:42 PM - Feb 05, 2024
0
2
Bev Turner
A
In response to Bob - Garden is Life.
Thank you!
06:42 PM - Feb 05, 2024
0
2
Democracy!Equality! Equity!Compassion!
A
In response to Bob - Garden is Life.
Thanks Bob! That’s very helpful!
06:33 PM - Feb 05, 2024
0
1
SueBee Honey
A
In response to Bob - Garden is Life.
I read through and now I understand. Thank you for telling us in plain language!
05:18 PM - Feb 05, 2024
1
3
Bob - Garden is Life
A
In response to SueBee Honey.
😁👍️
05:19 PM - Feb 05, 2024
0
0

 

{{ notificationModalContent }} {{ promptModalMessage }}