Twitter urges users to change passwords after computer 'glitch' • Hacker News Board

Re: Twitter urges users to change passwords after computer 'glitch'

#131

Post by jwilliams » Thu, May 03, 2018, 10:03 PM UTC

chipperyman573 wrote: post #84

jwilliams wrote: post #21

The Tweet from the Twitter CTO on this: https://twitter.com/paraga/status/992135139994943488 "We are sharing this information to help people make an informed decision about their account security. We didn’t have to, but believe it’s the right thing to do." The "we didn't have to" is a little jarring given the scale of this.

>The "we didn't have to" is a little jarring given the scale of this. How come? I interpreted it to mean that no regulations required this, but they chose to anyway. Which is true.

There is very little to be gained or added from pointing out this was optional -- for some reason the CTO decided to make a point of it.

I think the tone matters. Particularly for matters like this.

To my ear (and many who replied to that Tweet) this reads as "we've decided to do you a favor." Which is very much not the case.

Re: Twitter urges users to change passwords after computer 'glitch'

#132

Post by anonytrary » Thu, May 03, 2018, 10:05 PM UTC

> Due to a bug, passwords were written to an internal log before completing the hashing process

This isn't a bug, it's incompetence. Remember folks, never, ever use the same password for two different websites. Assume all websites store your password in plain text even if they hash it at some point. With logging and tracking on steroids these days, I expect "bugs" like this to be commonplace.

Re: Twitter urges users to change passwords after computer 'glitch'

#133

Post by gowld » Thu, May 03, 2018, 10:07 PM UTC

Alex3917 wrote: post #118

MBCook wrote: post #114

Earlier quoted context omitted.

Last year a contractor deleted the president’s account. The fact it didn’t leave Twitter doesn’t mean everything is good. There are still a LOT of people who may have had some kind of access to this data.

> Last year a contractor deleted the president’s account. The fact that they undeleted it is strong evidence that he didn't have discretion in how he performed his job, and thus was actually an employee and not a contractor.

If my gardener leaves a rake on my driveway, I'll remove the rake. That doesn't make the gardener an employee.

Re: Twitter urges users to change passwords after computer 'glitch'

#134

Post by danjc » Thu, May 03, 2018, 10:07 PM UTC

taco_emoji wrote: post #105

oneeyedpigeon wrote: post #88

> The glitch was related to Twitter’s use of a technology known as “hashing” that masks passwords as a user enters them by replacing them with numbers and letters, according to the blog. Sigh. They appear to have confused hashing with asterisks. > A bug caused the passwords to be written on an internal computer log before the hashing process was completed, the blog said. So "related" in almost no way whatsoever, then…

This is the phrasing from Twitter's actual blog post[0]: > We mask passwords through a process called hashing using a function known as bcrypt, which replaces the actual password with a random set of numbers and letters that are stored in Twitter’s system. Which is slightly better, I guess. [0] https://blog.twitter.com/official/en_us/topics/company/2018/...

I'm really not sure that's better. They're not using "masking" and "random" in the way those words would normally be interpreted.

Re: Twitter urges users to change passwords after computer 'glitch'

#135

Post by gowld » Thu, May 03, 2018, 10:09 PM UTC

jms703 wrote: post #66

minimaxir wrote: post #33

Twitter's CTO had an odd tweet about this disclosure (emphasis mine): > We are sharing this information to help people make an informed decision about their account security. We didn’t have to, but believe it’s the right thing to do. https://twitter.com/paraga/status/992135139994943488

"I should not have said we didn’t have to share. I have felt strongly that we should. My mistake." https://twitter.com/paraga/status/992146630232043520

Felt strongly that [Twitter] should have... "said we didn't have to share"? "shared"?

Parag needs a Comms director to handle is Twitter account.

Re: Twitter urges users to change passwords after computer 'glitch'

#136

Post by colemickens » Thu, May 03, 2018, 10:10 PM UTC

tptacek wrote: post #121

colemickens wrote: post #60

Earlier quoted context omitted.

I suspect that many more employees at Twitter have access to the logs, than have access to a super computer and pasword hashes. I know I wouldn't trust my password with the number of people that have easy access to logs at other large(ish) tech companies. I really can't imagine why "we didn't have to" was included in that tweet, at all. What other flaps like this have occurred that exposed my creds or personal data t…

More employees at virtually every major web company have access to instances (and thus instance memory) than have access to supercomputer clusters, too. Every mainstream popular web application is fed a constant high-volume feed of plaintext passwords, right there in memory (or, in typical TLS termination environments, on the wire) to be read by a persistent attacker.

That's true for nearly every single internet facing service, no? A compromise resulting in point-in-time access to traffic is a bit different than a bug that creates a persisted historical record of every single user who signed in for a period.

Maybe I miss the point behind this comparison? I guess I'd understand more if I thought the number of folks with node access and log access were in the same magnitude at Twitter, or if the TLS stack persisted data over time.

Re: Twitter urges users to change passwords after computer 'glitch'

#137

Post by [deleted] » Thu, May 03, 2018, 10:10 PM UTC

tzs wrote: post #79

A couple of steps you can take to reduce the chances of accidentally putting sensitive information in a log. 1. Make a list of all sensitive information that the test users in your test environment will be giving to your application. As part of your test procedure, search all logs for that information. This can be as simple as having a text file with all the sensitive information, and doing a 'grep -F -f sensitive.tx…

[deleted]

Re: Twitter urges users to change passwords after computer 'glitch'

#138

Post by racer-v » Thu, May 03, 2018, 10:10 PM UTC

calebh wrote: post #99

I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…

I keep all my passwords in a text file. I can't imagine remembering them all. I suppose I should keep that file encrypted and synced to multiple devices with rsync or so. Would a password manager give me any advantage over this scheme?

Re: Twitter urges users to change passwords after computer 'glitch'

#139

Post by madeofpalk » Thu, May 03, 2018, 10:11 PM UTC

chipperyman573 wrote: post #84

jwilliams wrote: post #21

The Tweet from the Twitter CTO on this: https://twitter.com/paraga/status/992135139994943488 "We are sharing this information to help people make an informed decision about their account security. We didn’t have to, but believe it’s the right thing to do." The "we didn't have to" is a little jarring given the scale of this.

>The "we didn't have to" is a little jarring given the scale of this. How come? I interpreted it to mean that no regulations required this, but they chose to anyway. Which is true.

So Twitter found out they had a bug that caused them to store passwords in one of their databases in plaintext. Their response is just a generic 'hey maybe you want to store your password'.

Compare that to Github who just yesterday went through the exact same problem, except they're requiring users change their password. Their CTO didn't make some 'hey you should THANK US" claim.

Re: Twitter urges users to change passwords after computer 'glitch'

#140

Post by springbrunnen » Thu, May 03, 2018, 10:13 PM UTC

calebh wrote: post #99

I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…

I'm skeptical whether it is really worth it to trust yet another party that can potentially be bribed by intelligence agencies and what not; or even hacked. No. I sit down once a year and think of CorrectHorseBatteryStaple-like passwords [1] for each important service, where each password is a relatively complex function (involving deletions, insertions, swaps, associations, numbers and special characters) of details of my life, the current year, the service in question and the username. That way I have a unique password for each service and I can easily reconstruct it based on that sort of easily recallable information.

[1] https://xkcd.com/936/