Mark Zuckerberg's multi-account password was 'dadada'

https://thestack.com/security/2016/06/06/zuckerberg-dadada-linkedin-ourmine-breach/

182 78 10 years ago

IIAOPSW• 10 years ago

to which I say "hahaha"

In all seriousness, many people choose shit passwords for the accounts they don't care about. I'm sure Mark's password for his admin account on fb is probably harder to guess.

artofcode• 10 years ago

dadada1

colejohnson66• 10 years ago

Which raises the entropy from 2^6 (64) to 3^7 (2187)! An increase by over 3000%! So much more secure!

frou_dh• 10 years ago

many people choose shit passwords for the accounts they don't care about

Surely any account tied to your real name / identity is something worth caring about. Doesn't matter how crappy/uninteresting the site is (or becomes), you still don't want to make it easy for someone to take over the account and be impersonating you.

detaro• 10 years ago

https://news.ycombinator.com/item?id=11842635

kriro2• 10 years ago

That'll be an excellent example on many security talk slides in the future (PW strength, reuse of PWs, salting)

They probably could have made some money by combining some day trading of FB stock with a well timed announcement of resignation due to health concerns or something. Announce, anticipate drop, buy...leak it was fake, sell. Or whatever else you can come up with with some thinking. [maybe not because he'd post that on FB]

deanCommie• 10 years ago

I don't understand your logic.

"If you're going to trespass on someone's property you might as well deface it and steal some of their stuff"

I am not a lawyer but I could see password breaching in the interest of white hat security could be is looked an a lot differently by the courts than what you're suggesting

kriro2• 10 years ago

I believe the passwords came from the 2012 LinkedIn breach and was referring to the original criminals. If you have the criminal energy to steal that data you might as well use it. I don't think there was anything white hat about that incident.

jacquesm2• 10 years ago

Sounds like an excellent way to spend some time in jail.

MichaelGG• 10 years ago

Think so? I'm sure lots of people have limit orders in at low prices, so that part alone isn't suspicious. But it might put you on a shortlist of potential hacker suspects.

uola• 10 years ago

It would be an excellent example in a security talk 10 years ago. If anything it should be used to promote better authentication solutions.

tajen• 10 years ago

Anyone knows a CEO who used "cube" as a password? I wonder why the top of the extremely competent people can be so sloppy sometimes. I'll suggest that's what you get when you found a startup straight after uni: You don't understand what it's like to jump through employment hoops.

vthallam• 10 years ago

I'll suggest that's what you get when you found a startup straight after uni

There's no statistical correlation for this. If anything, i would say it's the opposite, most of the young founders knows the importance of the security in this day and age.

jasonlotito• 10 years ago

I'd say that it makes the argument that reuse of passwords is more dangerous than simply using poor passwords. After all, it's complexity didn't seem to matter in this case. In fact, one could argue that the only thing a user of a site need concern themselves with is not using the same password in multiple locations. Once that is achieved, I wonder, if the chances of your account being hacked dramatically decrease more than any other safety precaution you can take, apart from simply not having any account.

elorant• 10 years ago

And then they'd spend all that money hiring lawyers to keep them out of jail. First rule of hacking is to stay away from high profile targets because they attract too much attention. I think they handled it nicely. They exposed the vulnerability without doing anything harmful.

cloudjacker• 10 years ago

First rule of hacking is to separate liability to stay out of jail.

Prosecution is typically limited because the person that discovers the hack isn't the person that exploits the hack, isn't the person day trading Facebook stock after the fake press releases.

And of course - and still up for controversy - selling hacks isn't restricted in any way right now.

caseysoftware• 10 years ago

There are way more subtle ways to cause problems and make money that would be less likely to land you in jail.

Are you an entrepreneur? What is it worth to have "Mark" tweet about your company/product? Or maybe make a warm intro to a top tier investor?

Sure, none of them are likely to radically change your business but some things just need a little push to get going and turn into something bigger.

I wrote about this (and other) scenarios in 2010: http://caseysoftware.com/blog/social-media-for-social-evil-p...

mvdwoord• 10 years ago

“No Facebook systems or accounts were accessed… The affected accounts have been re-secured.”

Sounds to me like they weren't very secure to begin with. So they would be "secured" now, not "re-secured". It's crap like this that makes me miss George Carlin.

Puts• 10 years ago

I'm waiting for the dadada t-shirt. :D

frgewut• 10 years ago

Here you go http://www.zazzle.com/dadada_tee_shirt-235801669209689823

scandox• 10 years ago

"...though at $50 a claimant, no-one stood to be much enriched out of the settlement..."

The lawyers must find that mildly amusing.

junto• 10 years ago

How do I go about claiming my $50?

jasonlfunk• 10 years ago

You file the claim form and submit it before May of last year... But you also had to have paid for LinkedIn premium for to be eligible.

Source: www.linkedinclassactionsettlement.com

augustt• 10 years ago

Makes me wonder how securely passwords were stored when he first opened Facebook to colleges.

D81Q3KJE81• 10 years ago

Everyone who works at Facebook should watch out right now. Endgame Systems (CIA) is trying to hack profiles right not to terrorize people. This is only the beginning.

satai• 10 years ago

Memes are coming...

PunchTornado• 10 years ago

I am using that password for dummy accounts (internal) all the time. As an Eastern European it means something in the language (yes). What does it mean in English?

back_beyond• 10 years ago

I am not aware of any meaning in English

fit2rule• 10 years ago

Was ist los mit dir, mein Schatz?

https://www.youtube.com/watch?v=lNYcviXK4rg

takno2• 10 years ago

It's what pre-verbal toddlers tend to call their male parent in the UK. They'd often stop at just dada, but everybody knows 4 character passwords are insecure

spacemanmatt• 10 years ago

Ich lieb dich nicht, du liebst mich nicht. Da da da!

(am I the only one who remembers Trio of their song that VW used in ads a few years ago?)

Keyframe• 10 years ago

Don't know about the ad, but I remember the 80's.

cha5m• 10 years ago

And see here I was about to go and change all my passwords...

adzm• 10 years ago

All I can think of is that song... Ich lieb' dich nicht, du liebst mich nicht. Da da da.

stefanix• 10 years ago

relevant https://www.youtube.com/watch?v=lNYcviXK4rg

amelius• 10 years ago

How is that possible? Many systems require at least 1 digit, and/or at least an uppercase character.

chiph• 10 years ago

Yes. These days they do. It wasn't so in the past. Look at how many times the four-letter sequence "asdf" shows up in password dumps.

darklajid• 10 years ago

Which usually doesn't help in the slightest and is merely annoying. dadada vs dada123 is .. not exactly an improvement.

phyzome• 10 years ago

I had no idea he was into avant-garde art!

(https://en.wikipedia.org/wiki/Dada)

roberthahn• 10 years ago

As soon as I saw the password I wondered if Mark was left-handed.

Turns out I was spot on: a bit of googling revealed he was.

tjoff• 10 years ago

Why? A password as simple as dadada has the great advantage that one can write it quickly with one hand - and for this you typically choose a password that you can write with your other hand on the mouse for when you are using it.

jobigoud• 10 years ago

But you can access more than 20 keys with your left hand, including numbers and special characters, it's no excuse.

arcanus2• 10 years ago

I'm a southpaw myself, and therefore quite biased, but I've always been struck by the prevalence of CEOs, Presidents, notable scientists, etc. that I have met who are fellow lefties. Don't have a p-value, but it seems much higher than the ambient (~10%) rate.

For instance, for the last 4-5 years in our computational science research group, we have been sitting pretty steadily near 50%.

rjsw• 10 years ago

At my PPOE it was 50% too. I can remember being in meetings where everyone except one PHB was left handed.

qrendel• 10 years ago

Selection bias? There are some studies indicating left-handed children tend to score lower (on average) on IQ, verbal scores, etc: http://www.ncbi.nlm.nih.gov/pubmed/16643966 (Edit: Seems the IQ difference varies between studies and is negligible, if even exists.)

Hypothesis is that left-handedness can be caused by early brain trauma, so if "lefties" are disproportionately represented in such positions, the ones with non-pathological causes would seem to have an even bigger advantage over the right-handed to make up for the lower mean. Or perhaps it's associated with other talents that make up for the deficits. (Edit: Wikipedia seems to support this - https://en.wikipedia.org/wiki/Handedness#Intelligence)

Or perhaps the research conclusions are just wrong.

grogenaut2• 10 years ago

I'm a righty... so my left hand never leaves the keyboard my right moves all over the place dadada is super easy for me to type. I would think if you're a lefty and using a laptop like most ceos are likely to be doing (if they have a laptop at all) then your left hand is on the mouse making dadada harder to hit?

geerlingguy• 10 years ago

Lefty here... but as with many other things in life (e.g. gloves, golf clubs, etc.), the prevalence of 'right handed' mice forced me into being a mouse/trackpad righty.

Most left-handed people I know have a mixture of left/right-handedness, whereas it seems all the right-handed people are right all the way.

thebaearea• 10 years ago

Guessing not.

http://static4.businessinsider.com/image/4dde798949e2ae723d0...

http://leadinvestor.com.au/wp-content/uploads/2014/08/mark-z...

visakanv2• 10 years ago

You could be right handed and use a password like !@#asdQWEewq#@!123 (using the pinky on the shift) because it doesn't require you to take your right hand off the mouse

frade33• 10 years ago

still better than me ... abc123

massysett• 10 years ago

As long as we have way too many unnecessary passwords, this will happen.

Merchants have figured this out. Many now allow purchases without creating an account (no doubt also because if people have to create another password, some will just abandon the purchase.)

I was reading about the Eero router. They figured this out. They get the user's phone number and send a token by text.

Passwords are horrible for usage and horrible for security. Just horrible all around.

hackim• 10 years ago

haha easy to remember..

sakri• 10 years ago

So the combination is... da, da, da? That's the stupidest combination I've ever heard in my life! That's the kind of thing an idiot would have on his luggage!

jasonellis• 10 years ago

da, da, da?

That's amazing! I've got the same combination on my luggage!

lfowles• 10 years ago

An infant could have come up with that combination!

d3ckard• 10 years ago

Well...

https://www.youtube.com/watch?v=L7abNYC0KQI

lfottaviano• 10 years ago

I think he was paying to someone else to manage his media.

patrickmay• 10 years ago

Daddy issues?

Sami_Lehtinen2• 10 years ago

Since when has SHA1 been crackable in three days? AFAIK with proper passwords SHA1 is nearly impossible to crack. Did I get something wrong? Salting does make the process slower with bad passwords, but with good ones there's very little difference. Just my gut feeling.

gravypod• 10 years ago

It seems like it's easy to find collisions from the hash.

https://www.schneier.com/blog/archives/2005/02/sha1_broken.h...

Sami_Lehtinen2• 10 years ago

But in case of passwords, the input masking (limited character set, length etc) makes most of found collisions nonviable? Because can't just freely enter colliding bits for the algorithm.

heimatau• 10 years ago

Yes, here is more info on SHA1 being broken.

https://crypto.stackexchange.com/questions/3690/no-sha-1-col...

deadowl2• 10 years ago

There's nothing to stop anyone from creating a reverse lookup table by systematically generating strings and their hash, and aside from dictionary words, this is an example of low hanging fruit. It's a repeated sequence of characters, which would be the second most obvious heuristic (after the dictionary) when trying to generate plausible passwords and their associated SHA1 hash.

Before the LinkedIn leak, I was guilty of sharing passwords across sites, and I got a wake up call by a "someone tried resetting your password" email. Started resetting them all, got to the point where I noticed there were a lot and I should probably use a password manager. Eventually I found out I had over 100 online accounts for various things, all of them now having unique passwords. I've deleted a handful of them (e.g. MySpace, MyCokeRewards). There are a couple more I'm trying to get deleted (e.g. Dominos) but haven't been successful yet.

roadnottaken2• 10 years ago

I thought salting was to stop precisely this sort of attack, no?

l1feh4ck• 10 years ago

Its kinda hard to believe that he used "dadada" as a password. Anyone who have a bit of understanding about how passwords are cracked would never use such a sloppy password. And he had one password for all the social accounts? Ew... How could he be so stupid?

CGamesPlay• 10 years ago

Mark Zuckerberg doesn't care about his Pinterest and Twitter accounts. He created them to scope out the competition and doesn't care if they get compromised. That's why his Instagram didn't get affected; he does care about that one (or at least somebody on the team of people he employs to protect the security of his websites does).

Now, I'll bet the lesson Zuck takes away from this is actually that other people care more about his Pinterest than he does (e.g. If John Doe sees Zuck pin something John may be much more likely to check that product out).

takno2• 10 years ago

So the takeaway is to use a fake name as well

zerooneinfinity• 10 years ago

Maybe ahahah is another password - https://www.youtube.com/watch?v=lNYcviXK4rg

Mark Zuckerberg's multi-account password was 'dadada'

Related Stories