Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter urges users to change passwords after computer 'glitch'

reuters.com

Post reply on HN
Print view View original

81–90 of 490 posts

Re: Twitter urges users to change passwords after computer 'glitch'

#81

Post by natch »

bomb199 wrote: post #25
jwilliams wrote: post #21

The Tweet from the Twitter CTO on this: https://twitter.com/paraga/status/992135139994943488 "We are sharing this information to help people make an informed decision about their account security. We didn’t have to, but believe it’s the right thing to do." The "we didn't have to" is a little jarring given the scale of this.

Well, nothing ever left Twitter's servers. The logs themselves would probably be uninteresting to outside parties and inaccessible.

>Well, nothing ever left Twitter's servers.

Nothing is known to have ever left Twitter's servers.

FTFY.

Re: Twitter urges users to change passwords after computer 'glitch'

#82

Post by chatmasta »

krallja wrote: post #68
panarky wrote: post #51

Earlier quoted context omitted.

Is it insecure to bcrypt/scrypt on the client instead so the server never sees the plaintext password?

Then anyone with a copy of your DB can log in by sending the hash directly. It’s identical to storing plain text passwords.

You could hash it twice, once at the client and once at the server. So your database would store a hash of a hash.

But without persistence on the client side you wouldn’t be able to do salting in the first hash (where do you store the salt?)

Re: Twitter urges users to change passwords after computer 'glitch'

#83

Post by always_good »

SahAssar wrote: post #63
xd1936 wrote: post #28

Earlier quoted context omitted.

"[We] are implementing plans to prevent this bug from happening again" sure makes it sound like this bug is still happening. Should we wait a couple of days before changing passwords? Will it end up in this log right now, just like the old one?

~~Sounds more like "we fixed this bug, and will ignore the processes that led to it happening" bullshit to me.~~

And this comment sounds more like "DAE hate twitter."

Their response is acceptable and textbook. Doesn't really seem like the appropriate place to wage the battle.

Re: Twitter urges users to change passwords after computer 'glitch'

#84

Post by chipperyman573 »

jwilliams wrote: post #21

The Tweet from the Twitter CTO on this: https://twitter.com/paraga/status/992135139994943488 "We are sharing this information to help people make an informed decision about their account security. We didn’t have to, but believe it’s the right thing to do." The "we didn't have to" is a little jarring given the scale of this.

>The "we didn't have to" is a little jarring given the scale of this.

How come? I interpreted it to mean that no regulations required this, but they chose to anyway. Which is true.

Re: Twitter urges users to change passwords after computer 'glitch'

#85

Post by [deleted] »

aaronbrethorst wrote: post #29
zerostar07 wrote: post #10

Earlier quoted context omitted.

"Technology by legislation" - that's the new trend it seems. How about replacing passwords with something technologically superior instead?

It isn't a new trend. Section 508 of the Rehabilitation Act legislated that the government purchase accessible software. HIPAA legislated that your medical data be kept secure. Minnesota, Nevada, and Washington have enshrined some or all of PCI DSS into law: https://en.wikipedia.org/wiki/Payment_Card_Industry_Data_Sec... A little farther afield, seat belt technology has been legally mandated to be included in most au…

[deleted]

Re: Twitter urges users to change passwords after computer 'glitch'

#86

Post by swypych »

abhishekjha wrote: post #42
spike021 wrote: post #13

>Due to a bug, passwords were written to an internal log before completing the hashing process. Hate to speculate, but it sounds possibly like perhaps a debug statement/log level had been enabled for testing and forgotten about?

Pretty much. Apparently github did something similar and now people are curious about the library/framework. Why is it so obvious that they both used the same library?

my thoughts exactly, wondering what they are all using.

Re: Twitter urges users to change passwords after computer 'glitch'

#87

Post by Jare »

mithr wrote: post #40
spike021 wrote: post #13

>Due to a bug, passwords were written to an internal log before completing the hashing process. Hate to speculate, but it sounds possibly like perhaps a debug statement/log level had been enabled for testing and forgotten about?

You wouldn't even need that -- just a request log that included the request body without sanitizing it first :)

That would have never happened to me. Not ever!

Re: Twitter urges users to change passwords after computer 'glitch'

#88

Post by oneeyedpigeon »

> The glitch was related to Twitter’s use of a technology known as “hashing” that masks passwords as a user enters them by replacing them with numbers and letters, according to the blog.

Sigh. They appear to have confused hashing with asterisks.

> A bug caused the passwords to be written on an internal computer log before the hashing process was completed, the blog said.

So "related" in almost no way whatsoever, then? The state of technology reporting in the mainstream press really makes me despair sometimes.

Re: Twitter urges users to change passwords after computer 'glitch'

#89

Post by praneshp »

tzs wrote: post #79

A couple of steps you can take to reduce the chances of accidentally putting sensitive information in a log. 1. Make a list of all sensitive information that the test users in your test environment will be giving to your application. As part of your test procedure, search all logs for that information. This can be as simple as having a text file with all the sensitive information, and doing a 'grep -F -f sensitive.tx…

Do you know of an elegant way to do this when working with protobufs? Ideally, mark a field 'password', and the generated class' __str__ equivalent returns ""

Re: Twitter urges users to change passwords after computer 'glitch'

#90

Post by Johnny555 »

oneeyedpigeon wrote: post #88

> The glitch was related to Twitter’s use of a technology known as “hashing” that masks passwords as a user enters them by replacing them with numbers and letters, according to the blog. Sigh. They appear to have confused hashing with asterisks. > A bug caused the passwords to be written on an internal computer log before the hashing process was completed, the blog said. So "related" in almost no way whatsoever, then…

The state of technology reporting in the mainstream press really makes me despair sometimes.

The problem is that the mainstream press writes for mainstream users, and the state of science/technology understanding in the general public is the real problem.

Post reply on HN