Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter urges users to change passwords after computer 'glitch'

reuters.com

Post reply on HN
Print view View original

111–120 of 490 posts

Re: Twitter urges users to change passwords after computer 'glitch'

#111

Post by rdiddly »

chipperyman573 wrote: post #84
jwilliams wrote: post #21

The Tweet from the Twitter CTO on this: https://twitter.com/paraga/status/992135139994943488 "We are sharing this information to help people make an informed decision about their account security. We didn’t have to, but believe it’s the right thing to do." The "we didn't have to" is a little jarring given the scale of this.

>The "we didn't have to" is a little jarring given the scale of this. How come? I interpreted it to mean that no regulations required this, but they chose to anyway. Which is true.

It's kind of like pre-emptively defending yourself against an accusation that hasn't been made yet.

Re: Twitter urges users to change passwords after computer 'glitch'

#112

Post by testplzignore »

CiPHPerCoder wrote: post #96

I've seen this scenario unfold before: 1. User provides username/password. 2. An exception occurs somewhere. 3. The stack trace from the exception is logged. 4. The stack trace includes the credentials. 5. The exception ends up in a ticketing system (Trac, JIRA, etc.) 6. Nobody notices for years.

As a bonus, sometimes the stack trace will be returned to the user, and maybe it'll contain server-side secrets, too!

Re: Twitter urges users to change passwords after computer 'glitch'

#113

Post by beberlei »

CiPHPerCoder wrote: post #96

I've seen this scenario unfold before: 1. User provides username/password. 2. An exception occurs somewhere. 3. The stack trace from the exception is logged. 4. The stack trace includes the credentials. 5. The exception ends up in a ticketing system (Trac, JIRA, etc.) 6. Nobody notices for years.

Or all the environment variables containing tons of password+tokens, or in javascript libraries all the headers, including cookies that could be used to overtake a session. Error/Exception tracking software is quite dangerous if it written with a "lets store everything, because it could help find the problem" mindest.

Re: Twitter urges users to change passwords after computer 'glitch'

#114

Post by MBCook »

bomb199 wrote: post #25
jwilliams wrote: post #21

The Tweet from the Twitter CTO on this: https://twitter.com/paraga/status/992135139994943488 "We are sharing this information to help people make an informed decision about their account security. We didn’t have to, but believe it’s the right thing to do." The "we didn't have to" is a little jarring given the scale of this.

Well, nothing ever left Twitter's servers. The logs themselves would probably be uninteresting to outside parties and inaccessible.

Last year a contractor deleted the president’s account.

The fact it didn’t leave Twitter doesn’t mean everything is good. There are still a LOT of people who may have had some kind of access to this data.

Re: Twitter urges users to change passwords after computer 'glitch'

#116

Post by alorimer »

chipperyman573 wrote: post #84
jwilliams wrote: post #21

The Tweet from the Twitter CTO on this: https://twitter.com/paraga/status/992135139994943488 "We are sharing this information to help people make an informed decision about their account security. We didn’t have to, but believe it’s the right thing to do." The "we didn't have to" is a little jarring given the scale of this.

>The "we didn't have to" is a little jarring given the scale of this. How come? I interpreted it to mean that no regulations required this, but they chose to anyway. Which is true.

Regardless, it seems very defensive. A company that looks after their users "because they choose to" is a lot more suspicious than one where customer care is simply assumed to be inherent to the operation.

Re: Twitter urges users to change passwords after computer 'glitch'

#117

Post by reificator »

xd1936 wrote: post #28
fatratchet wrote: post #6

Actual twitter post: https://blog.twitter.com/official/en_us/topics/company/2018/... "Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again." Exact same thing that github did just recently.

"[We] are implementing plans to prevent this bug from happening again" sure makes it sound like this bug is still happening. Should we wait a couple of days before changing passwords? Will it end up in this log right now, just like the old one?

No, it sounds like a reasonable bugfixing strategy. Identify the bug, identify the fastest way to resolve it, then once it's fixed figure out how to ensure it never happens again, and what to do if it does.

Re: Twitter urges users to change passwords after computer 'glitch'

#118

Post by Alex3917 »

MBCook wrote: post #114
bomb199 wrote: post #25

Earlier quoted context omitted.

Well, nothing ever left Twitter's servers. The logs themselves would probably be uninteresting to outside parties and inaccessible.

Last year a contractor deleted the president’s account. The fact it didn’t leave Twitter doesn’t mean everything is good. There are still a LOT of people who may have had some kind of access to this data.

> Last year a contractor deleted the president’s account.

The fact that they undeleted it is strong evidence that he didn't have discretion in how he performed his job, and thus was actually an employee and not a contractor.

Re: Twitter urges users to change passwords after computer 'glitch'

#119

Post by [deleted] »

MBCook wrote: post #114
bomb199 wrote: post #25

Earlier quoted context omitted.

Well, nothing ever left Twitter's servers. The logs themselves would probably be uninteresting to outside parties and inaccessible.

Last year a contractor deleted the president’s account. The fact it didn’t leave Twitter doesn’t mean everything is good. There are still a LOT of people who may have had some kind of access to this data.

[deleted]

Re: Twitter urges users to change passwords after computer 'glitch'

#120

Post by hakanito »

calebh wrote: post #99

I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…

+1 for 1Password. Never looked back. Great for all sorts of passwords/credit cards/private keys. It also syncs to the 1Pass app on your phone.
Post reply on HN