Edwin MEMBER_OF The Guild of the Grumpy Old Hackers
Edwin is one of the members of The Guild of the Grumpy Old Hackers.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“So, collectively you’re called what?”
“I’m Edwin. I’m old.”
Episode
16 March 2021 Official episode · Official transcript
research
The episode covers the 2016 compromise of Donald Trump’s Twitter account by the Guild of the Grumpy Old Hackers, who reused a password exposed in the LinkedIn breach and reported the issue through responsible disclosure.
Topics: LinkedIn credential breach and public database dumps, Password reuse and credential stuffing, SHA-1 password hashes and lack of salting, SMTP email enumeration and the VRFY command, Open-source intelligence gathering, User-agent spoofing and geographic login controls, Open HTTP proxy use, Responsible and coordinated vulnerability disclosure, Two-factor authentication, Password reset protection, Security of high-profile and election-related social media accounts
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Edwin MEMBER_OF The Guild of the Grumpy Old Hackers
Edwin is one of the members of The Guild of the Grumpy Old Hackers.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“So, collectively you’re called what?”
“I’m Edwin. I’m old.”
Matt MEMBER_OF The Guild of the Grumpy Old Hackers
Matt is one of the members of The Guild of the Grumpy Old Hackers.
Explicit Confidence 98% · Jack Rhysider EP 87 Details
“Also on the call is Matt.”
“My name is Matt and I spent a twenty-year professional computer security career”
Victor MEMBER_OF The Guild of the Grumpy Old Hackers
Victor is identified as one of the three hackers in the Guild who hacked Donald Trump's Twitter account.
Explicit Confidence 96% · Jack Rhysider EP 87 Details
“I called up the three guys that in 2016 hacked Donald Trump’s Twitter account.”
“Then there’s Victor.”
The Guild of the Grumpy Old Hackers ASSOCIATED_WITH Dutch Institute of Vulnerability Disclosure
The Guild members work with the Dutch Institute of Vulnerability Disclosure.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“Victor works with the Dutch Institute of Vulnerability Disclosure, something Edwin and Matt help out with, too.”
The Guild of the Grumpy Old Hackers ASSOCIATED_WITH Hack_Right
The Guild works with Hack_Right, a Dutch law-enforcement program intended to redirect young offenders toward ethical hacking.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“They work with Hack_Right, a Dutch law enforcement program that helps put young offenders back on track.”
The Guild of the Grumpy Old Hackers ASSOCIATED_WITH BruCON
The Guild members attended BruCON in Belgium when the Trump account incident began.
Explicit Confidence 99% · Edwin EP 87 Details
“We were at a conference called BruCON in Belgium.”
Trump Twitter account compromise (2016) COMPROMISES Twitter
The incident resulted in the Guild obtaining full access to Donald Trump's Twitter account.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“They had full access to real Donald Trump’s Twitter account.”
Trump Twitter account compromise (2016) ATTRIBUTED_TO The Guild of the Grumpy Old Hackers
The 2016 Trump Twitter account compromise is attributed in the episode to The Guild of the Grumpy Old Hackers.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“The second time his Twitter account got hacked was in 2016, the year he was running for president, and it was done by some grumpy old hackers.”
“the three guys that in 2016 hacked Donald Trump’s Twitter account”
Trump Twitter account compromise (2016) INITIAL_ACCESS_VIA password reuse
The group gained access using Trump's LinkedIn password, 'yourefired', which was still valid for Twitter in 2016.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“Donald Trump was still using ‘yourefired’ as his Twitter password in 2016”
“we were in his Twitter account a couple of days before the election”
The Guild of the Grumpy Old Hackers USES password reuse
The Guild tested a password recovered from Trump's LinkedIn credentials against his Twitter account.
Derived Confidence 99% · Matt EP 87 Details
“Would he be so stupid to use – to reuse his password for his Twitter accounts?”
“He went straightaway to twitter.com, typed in the username @realDonaldTrump and typed in the password ‘yourefired’.”
The Guild of the Grumpy Old Hackers USES Open-source intelligence
The Guild used publicly available information to identify possible email addresses associated with Trump.
Explicit Confidence 99% · Victor EP 87 Details
“We acted on OSINT. We acted on publicly available information”
The Guild of the Grumpy Old Hackers USES SMTP enumeration
The Guild used SMTP enumeration on Trump's domains to identify valid email addresses.
Explicit Confidence 99% · Victor EP 87 Details
“we used SMTP enumeration on his domains, over the e-mail domains.”
Metasploit USES SMTP enumeration
Jack explains that Metasploit can perform SMTP enumeration.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“It’s called Metasploit and Metasploit can do a lot of things.”
“one thing it can do is SMTP enumeration”
The Guild of the Grumpy Old Hackers USES User-agent spoofing
The Guild modified its user agent to imitate Trump's Samsung Galaxy S3.
Explicit Confidence 99% · Victor EP 87 Details
“You had to start messing with your user agent because you know that he’s using a very old Android phone”
“they switched their user agent to look like Trump’s Samsung S3”
The Guild of the Grumpy Old Hackers USES Open proxy routing
The Guild routed its traffic through an open HTTP proxy in New York to appear to be logging in from Trump's normal region.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“they used an open HTTP proxy in New York to route their traffic through that to log into Twitter”
The Guild of the Grumpy Old Hackers USES responsible disclosure
The Guild documented the access and reported the vulnerability to Trump and relevant authorities.
Explicit Confidence 99% · Victor EP 87 Details
“Now comes the responsible task of documenting everything”
“The Grumps put their findings and suggestions into an e-mail and sent it over to Trump.”
LinkedIn breach INVOLVES LinkedIn
The 2012 LinkedIn breach involved LinkedIn's website and database.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“back in 2012, LinkedIn’s website was breached”
LinkedIn breach INVOLVES SHA-1
The stolen LinkedIn data included SHA-1 hashed passwords.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“the data stolen from the LinkedIn breach was usernames, e-mail addresses, and SHA-1 hashed passwords”
LinkedIn breach INVOLVES Password salting
The episode says LinkedIn was not salting its passwords, making password cracking easier.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“LinkedIn wasn’t salting their passwords which is a way to make cracking passwords harder”
LinkedIn breach CONTAINS Personal identifiable information
The publicly circulated LinkedIn database dump contained user details including email addresses and passwords.
Explicit Confidence 94% · Jack Rhysider EP 87 Details
“The document that Edwin downloaded from Facebook simply contained the e-mail address and the cracked clear text password.”
The Guild of the Grumpy Old Hackers USES Credential stuffing
The Guild warned people that passwords exposed in the LinkedIn dump could be reused to access other accounts.
Explicit Confidence 98% · Victor EP 87 Details
“Most were very grateful because credential stuffing was not such a big topic in 2016 but it was going on.”
Donald Trump USES Twitter
Donald Trump used Twitter extensively, including as a public communication channel while president.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“Twitter was his mouthpiece for so many things.”
Donald Trump USES Samsung Galaxy S3
The episode reports that Trump was using a Samsung Galaxy S3 in 2016.
Attributed Confidence 96% · Jack Rhysider EP 87 Details
“Android Central deduced that in 2016, Trump was using the Samsung Galaxy S3.”
Twitter USES Password reset protection
Twitter made password reset protection a default setting for election-related accounts before the 2020 election.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“Twitter also made password reset protection a default setting.”
Twitter USES two-factor authentication
Twitter encouraged, but did not require, two-factor authentication for election-related accounts before the 2020 election.
Explicit Confidence 99% · Jack Rhysider EP 87 Details
“They encouraged but didn’t actually require two-factor authentication”
Trump Twitter account compromise (2016) ASSOCIATED_WITH LinkedIn breach
The episode suggests, but does not establish, that Trump's earlier Twitter compromise may have resulted from credentials exposed in the LinkedIn breach.
Uncertain Confidence 82% · Jack Rhysider EP 87 Details
“I just wonder if someone saw his password in that breach and that’s how they logged into Twitter then.”
“If so, why didn’t he change his password in 2013?”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:56:02.153907+00:00