Weak Password Brings ‘Happiness’ to Twitter Hacker

An example of importance of NIST Special Edition (SP) 800-14 can be a case with Twitter, when this service was hacked by 18 years old man, who used an automated password –guesser on users’ accounts. This would not happen if Twitter’s administrators confined a number of rapid-fire log-in attempts.  The hacker could used the password –guesser only because Twitter allowed unlimited number of log in efforts. “Weak Password Brings ‘Happiness’ to Twitter Hacker”   (http://www.wired.com/threatlevel/2009/01/professed-twitt/ ).  NIST (SP) 800-14 clearly says about necessity of limitation of log-on attempts (3.11.2 Authentication (3.11 Identification and Authentication)).  The fault rests not only on Twitter, but also with users who used easy to guess passwords. The software the hacker used pick up the passwords from a special dictionary, and if users would create complicated passwords, they would not come to harm.