The "right" way to handle this is to revoke access to all logged-in devices, revoke all previous passwords, send an email notifying users of the revocations, and force a password change upon next login. But Twitter won't do that because a non-trivial percentage of their user base would never jump through the hoops to get things up and running again and Twitter's MAU numbers would sink.
Twitter urges users to change passwords after computer 'glitch'
31–40 of 490 posts
Re: Twitter urges users to change passwords after computer 'glitch'
#32Earlier quoted context omitted.
"Technology by legislation" - that's the new trend it seems. How about replacing passwords with something technologically superior instead?
Superior technologies such as...?
The obvious one is public-private keys. Servers only ever get your public key.
Re: Twitter urges users to change passwords after computer 'glitch'
#33Twitter's CTO had an odd tweet about this disclosure (emphasis mine):
> We are sharing this information to help people make an informed decision about their account security. We didn’t have to, but believe it’s the right thing to do.
Re: Twitter urges users to change passwords after computer 'glitch'
#34The Tweet from the Twitter CTO on this: https://twitter.com/paraga/status/992135139994943488 "We are sharing this information to help people make an informed decision about their account security. We didn’t have to, but believe it’s the right thing to do." The "we didn't have to" is a little jarring given the scale of this.
Well, nothing ever left Twitter's servers. The logs themselves would probably be uninteresting to outside parties and inaccessible.
[deleted]
Re: Twitter urges users to change passwords after computer 'glitch'
#35We need a regulatory rulebook codified in law by congress that fines companies that make these "mistakes". Enough of a fine will force companies to take these "mistakes" seriously. In Yahoo's case, that might have forced Marissa to actually keep a cybersecurity team and not cut them when she knew the systems were in danger of being compromised. We aren't getting any jail time, but hefty fines that don't stifle growth…
Why? I have a small app with a few thousand users that generate almost no money but contain sensitive data - if I were to be fine because of a leak, I would be dead financially. Where do you draw the line between the companies that should be fine and those which don't?
No matter how advance our technology is or the security measures we take, any system connected to internet somehow will have a leak or an intrusion or something that compromise security.
Re: Twitter urges users to change passwords after computer 'glitch'
#36How is something like this even possible? It just sounds so incompetent.
This happens constantly.
You'd be surprised what's recorded in logs...
Re: Twitter urges users to change passwords after computer 'glitch'
#37How is something like this even possible? It just sounds so incompetent.
seriously? pretty easily. somebody probably left a debug log message in place or something. guaranteed that this happens all the time and most people don't report it.
Indeed. This is probably a good reminder for every developer to just go and check through their logs to see what is there. It can be quite a shock sometimes to find how much can get dumped there..
Re: Twitter urges users to change passwords after computer 'glitch'
#38The Tweet from the Twitter CTO on this: https://twitter.com/paraga/status/992135139994943488 "We are sharing this information to help people make an informed decision about their account security. We didn’t have to, but believe it’s the right thing to do." The "we didn't have to" is a little jarring given the scale of this.
Well, nothing ever left Twitter's servers. The logs themselves would probably be uninteresting to outside parties and inaccessible.
[deleted]
Re: Twitter urges users to change passwords after computer 'glitch'
#39How is something like this even possible? It just sounds so incompetent.
seriously? pretty easily. somebody probably left a debug log message in place or something. guaranteed that this happens all the time and most people don't report it.
As developer, I can tell you this happens more often than I'd like to admit.
debug logs is that necessary evil you need to troubleshoot pesky bugs. Unfortunately some of these debug tools need to be turned on in a live environment to capture those logs for debugging. But also Unfortunately, we are humans and we concentrate on fixing the bug and forget to turn off logging or log unnecessary data.
Re: Twitter urges users to change passwords after computer 'glitch'
#40>Due to a bug, passwords were written to an internal log before completing the hashing process. Hate to speculate, but it sounds possibly like perhaps a debug statement/log level had been enabled for testing and forgotten about?
You wouldn't even need that -- just a request log that included the request body without sanitizing it first :)