“We are very sorry this happened,” the Twitter blog said.
Twitter urges users to change passwords after computer 'glitch'
11–20 of 490 posts
Re: Twitter urges users to change passwords after computer 'glitch'
#12They don't say what the timeframe for this issue is. Have passwords been logged for the last 6 months? Last 3 years? Was this a bug found and fixed last year, and only now are they reporting it?
Re: Twitter urges users to change passwords after computer 'glitch'
#13>Due to a bug, passwords were written to an internal log before completing the hashing process.
Hate to speculate, but it sounds possibly like perhaps a debug statement/log level had been enabled for testing and forgotten about?
Re: Twitter urges users to change passwords after computer 'glitch'
#14We need a regulatory rulebook codified in law by congress that fines companies that make these "mistakes". Enough of a fine will force companies to take these "mistakes" seriously. In Yahoo's case, that might have forced Marissa to actually keep a cybersecurity team and not cut them when she knew the systems were in danger of being compromised. We aren't getting any jail time, but hefty fines that don't stifle growth…
I agree. But i'm not sure this sentiment applies here, twitter probably has an amazing security team and its clear that they were using good practices. they found a bug and disclosed the issue to their users.
Re: Twitter urges users to change passwords after computer 'glitch'
#15How is something like this even possible? It just sounds so incompetent.
[deleted]
Re: Twitter urges users to change passwords after computer 'glitch'
#16How is something like this even possible? It just sounds so incompetent.
seriously? pretty easily. somebody probably left a debug log message in place or something. guaranteed that this happens all the time and most people don't report it.
Re: Twitter urges users to change passwords after computer 'glitch'
#17must be the same logging library/framework as github. I want to know which library it is.
Re: Twitter urges users to change passwords after computer 'glitch'
#18They don't say what the timeframe for this issue is. Have passwords been logged for the last 6 months? Last 3 years? Was this a bug found and fixed last year, and only now are they reporting it?
We must assume the worst.
Re: Twitter urges users to change passwords after computer 'glitch'
#19We need a regulatory rulebook codified in law by congress that fines companies that make these "mistakes". Enough of a fine will force companies to take these "mistakes" seriously. In Yahoo's case, that might have forced Marissa to actually keep a cybersecurity team and not cut them when she knew the systems were in danger of being compromised. We aren't getting any jail time, but hefty fines that don't stifle growth…
"Technology by legislation" - that's the new trend it seems. How about replacing passwords with something technologically superior instead?
Superior technologies such as...?
Re: Twitter urges users to change passwords after computer 'glitch'
#20How is something like this even possible? It just sounds so incompetent.
HTTPS form submissions should be encrypted while the data travels between the user's computer and the server, but the server will still need to decrypt them to perform the hashing. It's possible, and probably even common, for inexperienced or forgetful developers to add request logging for debugging or diagnosing service outages without adding extra logic to scrub sensitive fields.