Twitter urges users to change passwords after computer 'glitch' • Hacker News Board

Re: Twitter urges users to change passwords after computer 'glitch'

#121

Post by tptacek » Thu, May 03, 2018, 9:51 PM UTC

colemickens wrote: post #60

bomb199 wrote: post #25

Earlier quoted context omitted.

Well, nothing ever left Twitter's servers. The logs themselves would probably be uninteresting to outside parties and inaccessible.

I suspect that many more employees at Twitter have access to the logs, than have access to a super computer and pasword hashes. I know I wouldn't trust my password with the number of people that have easy access to logs at other large(ish) tech companies. I really can't imagine why "we didn't have to" was included in that tweet, at all. What other flaps like this have occurred that exposed my creds or personal data t…

More employees at virtually every major web company have access to instances (and thus instance memory) than have access to supercomputer clusters, too. Every mainstream popular web application is fed a constant high-volume feed of plaintext passwords, right there in memory (or, in typical TLS termination environments, on the wire) to be read by a persistent attacker.

Re: Twitter urges users to change passwords after computer 'glitch'

#122

Post by lstamour » Thu, May 03, 2018, 9:54 PM UTC

Alex3917 wrote: post #118

MBCook wrote: post #114

Earlier quoted context omitted.

Last year a contractor deleted the president’s account. The fact it didn’t leave Twitter doesn’t mean everything is good. There are still a LOT of people who may have had some kind of access to this data.

> Last year a contractor deleted the president’s account. The fact that they undeleted it is strong evidence that he didn't have discretion in how he performed his job, and thus was actually an employee and not a contractor.

I’m not sure how that follows. Are you suggesting they don’t keep backups or use a “deletion” flag temporarily, e.g. as part of spam account removal?

Re: Twitter urges users to change passwords after computer 'glitch'

#123

Post by gsich » Thu, May 03, 2018, 9:55 PM UTC

Why even hash the password on the remote side, shouldn't some challenge-response hashing be more secure?

The most likely downside is that without JS it won't work.

Re: Twitter urges users to change passwords after computer 'glitch'

#124

Post by badloginagain » Thu, May 03, 2018, 9:56 PM UTC

jahvo wrote: post #67

fatratchet wrote: post #6

Actual twitter post: https://blog.twitter.com/official/en_us/topics/company/2018/... "Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again." Exact same thing that github did just recently.

It's funny, I wonder if hearing about that github bug made them check if they had committed the same mistake... only to find that they did :-)

I think I, and everyone here, should check as well. If capable, security-minded companies can make such a mistake, so can you.

Re: Twitter urges users to change passwords after computer 'glitch'

#125

Post by [deleted] » Thu, May 03, 2018, 9:57 PM UTC

[deleted]

Re: Twitter urges users to change passwords after computer 'glitch'

#126

Post by acjohnson55 » Thu, May 03, 2018, 9:58 PM UTC

This seems like the sort of problem that typed programming can vastly reduce. In a language where string representation is controlled by the data type itself, one could protect against emitting passwords in plaintext accidentally. You'd still be vulnerable until deserialization happens, but that's a lot less surface area to worry about.

Re: Twitter urges users to change passwords after computer 'glitch'

#127

Post by dcsommer » Thu, May 03, 2018, 9:58 PM UTC

calebh wrote: post #99

I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…

KeePass and Dropbox works great for me as a free alternative. I use the Kee plugin on Firefox and KeePass2Android on my phone.

I set it up to need both a private key and password to unlock my password DB. The private key moves around on a thumbdrive only (never in Dropbox).

I like that the only parts of this system I have to trust are open source.

Re: Twitter urges users to change passwords after computer 'glitch'

#128

Post by ConcernedCoder » Thu, May 03, 2018, 9:59 PM UTC

Thanks Twitter for making it easy to change my password. Took me all of 10 seconds to do that and review apps with twitter privileges.

Re: Twitter urges users to change passwords after computer 'glitch'

#129

Post by asdsa5325 » Thu, May 03, 2018, 9:59 PM UTC

Did GitHub's post make them realize this?

Re: Twitter urges users to change passwords after computer 'glitch'

#130

Post by chrischen » Thu, May 03, 2018, 10:01 PM UTC

calebh wrote: post #99

I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…

Everyone should be using a password manager. You can't really trust the average joe to be able to make secure passwords for the potentially dozens or hundreds of sites and services, and even if they do, they probably use just one secure password for everything.

I just wish there was more seamless support for apps to use 1Password to paste in passwords. There are still sites that prevent pasting into password fields!