Facebook founder MArk Zuckerberg briefly lost control of both his Twitter and Pinterest accounts this morning, after a hacker broke in to both, defacing the pages.

If the hacker, who went by the name OurMine, is to be believed, Zuckerberg’s weakness was in re-using passwords: they say they found his details in a database of 117 million passwords hacked from social network LinkedIn in 2012.

From there, they were able to gain access to his Twitter account, where they tweeted “you were in Linkedin Database … DM for proof”, and his Pinterest account, the name of which they changed to read “Hacked By OurMine Team”.

The hackers also claimed to have broken in to Zuckerberg’s account on (Facebook-owned) Instagram, but Facebook denies this happened, telling VentureBeat that: “No Facebook systems or accounts were accessed.”

Prior to the hack, Zuckerberg hadn’t tweeted from his Twitter account for four years. His last message on the service was a link to a now-deleted blogpost about SOPA, an American anti-piracy law, while the majority of his 19 tweets stem from a two month period in early 2009.

It is perhaps relaxing to know that, despite running one of the biggest websites in the world, Zuckerberg appears to have the same security weaknesses as the rest of us. Reusing passwords is a bad idea even if you aren’t a billionaire with a target painted on your back: the only account that should be at risk if LinkedIn gets hacked is a LinkedIn account, not a Pinterest and Twitter account too.

Twitter also supports two-factor authentication, ensuring that anyone trying to log in to the site must also have access to the phone number of the person whose account they’re logging in to. Pinterest doesn’t have that security feature, though, and even Twitter only introduced it a year after Zuckerberg’s most recent tweet.

There could be more hacks like Zuckerberg’s to come. The LinkedIn password dump, which came to light in May, was shortly followed by one three times as big from Myspace. The data may be eight years old, but with around 360 million accounts, there are sure to be some people still using the same email address and password.

(The Guardian)