Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter urges users to change passwords after computer 'glitch'

reuters.com

Post reply on HN
Print view View original

51–60 of 490 posts

Re: Twitter urges users to change passwords after computer 'glitch'

#51

Post by panarky »

Jach wrote: post #45
77pt77 wrote: post #9

How is something like this even possible? It just sounds so incompetent.

I'm curious if anyone has details on using bcrypt/scrypt at scale. Specifically one way I could see this happening is something like login requests go to a load balancer that puts the requests on a queue to be picked up and validated by some hasher service, and the queue ends up writing the requests to logs to recover from certain kinds of failures.

Is it insecure to bcrypt/scrypt on the client instead so the server never sees the plaintext password?

Re: Twitter urges users to change passwords after computer 'glitch'

#52

Post by jedimastert »

sneak wrote: post #44
uptown wrote: post #31

The "right" way to handle this is to revoke access to all logged-in devices, revoke all previous passwords, send an email notifying users of the revocations, and force a password change upon next login. But Twitter won't do that because a non-trivial percentage of their user base would never jump through the hoops to get things up and running again and Twitter's MAU numbers would sink.

That that is “right” is subjective. Twitter isn’t banking or ATC or healthcare.

True, but I could see a lot of livelihoods and careers being ruined by a malicious tweet.

Re: Twitter urges users to change passwords after computer 'glitch'

#54

Post by chatmasta »

thln666 wrote: post #16
77pt77 wrote: post #9

How is something like this even possible? It just sounds so incompetent.

seriously? pretty easily. somebody probably left a debug log message in place or something. guaranteed that this happens all the time and most people don't report it.

I doubt anyone left something that logged the plaintext password. No reasonable architecture necessitates holding onto a plaintext password for more than one line of code.

One possibility is an HTTP server on the request path after TLS termination. But then why is an HTTP server logging the request body?

My guess would be some sort of instrumentation process was blindly reading data in memory without distinguishing what the data was, but produced logs that incidentally included passwords.

Re: Twitter urges users to change passwords after computer 'glitch'

#55

Post by zeroxfe »

uptown wrote: post #31

The "right" way to handle this is to revoke access to all logged-in devices, revoke all previous passwords, send an email notifying users of the revocations, and force a password change upon next login. But Twitter won't do that because a non-trivial percentage of their user base would never jump through the hoops to get things up and running again and Twitter's MAU numbers would sink.

> The "right" way to handle this

... maybe in a vacuum. It's possible that if you had all the facts, you just might agree with their course of action.

Re: Twitter urges users to change passwords after computer 'glitch'

#56

Post by wlesieutre »

xd1936 wrote: post #28
fatratchet wrote: post #6

Actual twitter post: https://blog.twitter.com/official/en_us/topics/company/2018/... "Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again." Exact same thing that github did just recently.

"[We] are implementing plans to prevent this bug from happening again" sure makes it sound like this bug is still happening. Should we wait a couple of days before changing passwords? Will it end up in this log right now, just like the old one?

That sounds more like "We're adding a more thorough testing and code-review process for our password systems to prevent developers from accidentally logging unhashed passwords in the future".

Re: Twitter urges users to change passwords after computer 'glitch'

#57

Post by xur17 »

plopz wrote: post #43
robinhood wrote: post #35

Earlier quoted context omitted.

Why? I have a small app with a few thousand users that generate almost no money but contain sensitive data - if I were to be fine because of a leak, I would be dead financially. Where do you draw the line between the companies that should be fine and those which don't? No matter how advance our technology is or the security measures we take, any system connected to internet somehow will have a leak or an intrusion or…

Are you arguing that you should be allowed to be reckless because you cannot afford the cost of being careful?

He's arguing that there is a risk no matter how careful you are, which would prevent a lot of smaller developers from building anything at all.

Re: Twitter urges users to change passwords after computer 'glitch'

#58

Post by bdamm »

thln666 wrote: post #16
77pt77 wrote: post #9

How is something like this even possible? It just sounds so incompetent.

seriously? pretty easily. somebody probably left a debug log message in place or something. guaranteed that this happens all the time and most people don't report it.

Absolutely this happens all the time. I personally have seen it happen twice at two different companies.

Re: Twitter urges users to change passwords after computer 'glitch'

#60

Post by colemickens »

bomb199 wrote: post #25
jwilliams wrote: post #21

The Tweet from the Twitter CTO on this: https://twitter.com/paraga/status/992135139994943488 "We are sharing this information to help people make an informed decision about their account security. We didn’t have to, but believe it’s the right thing to do." The "we didn't have to" is a little jarring given the scale of this.

Well, nothing ever left Twitter's servers. The logs themselves would probably be uninteresting to outside parties and inaccessible.

I suspect that many more employees at Twitter have access to the logs, than have access to a super computer and pasword hashes.

I know I wouldn't trust my password with the number of people that have easy access to logs at other large(ish) tech companies.

I really can't imagine why "we didn't have to" was included in that tweet, at all. What other flaps like this have occurred that exposed my creds or personal data to large numbers of employees, that they didn't have and didn't choose to tell us about?

Post reply on HN