Why should I change my "passwords"? I only have one entry for Twitch in my password manager.
It's 2018, no sane person would reuse their passwords across multiple sites which can and do get hacked.
Twitter urges users to change passwords after computer 'glitch'
151–160 of 490 posts
Re: Twitter urges users to change passwords after computer 'glitch'
#152Actual twitter post: https://blog.twitter.com/official/en_us/topics/company/2018/... "Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again." Exact same thing that github did just recently.
So best practice would be that the cleartext password is never sent to the server, so they could never log it even accidentally. That means the hashing needs to be done client side, probably with JavaScript. Is there any safe way to do that?
Re: Twitter urges users to change passwords after computer 'glitch'
#153Back in my younger, move naive days when I first started using a password manager and such a practice was not as widespread, I had the same question I think most other people have: "If my computer gets hacked or infected, won't the attacker instantly grab all the passwords from the manager?" I chose to use a manager anyway, with the logic that if my system was compromised I was owned either way; memorizing passwords…
> The vast majority of password leaks we've seen over the past decade have been due not to malware but rather server compromises.
Something to consider is that malware-based compromises of personal systems don't raise as much brouhaha as corporate-level compromises.
Re: Twitter urges users to change passwords after computer 'glitch'
#154I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…
I keep all my passwords in a text file. I can't imagine remembering them all. I suppose I should keep that file encrypted and synced to multiple devices with rsync or so. Would a password manager give me any advantage over this scheme?
Yes. Among the many features a manager app like 1Password would provide is a way for easily pasting in a password to a login field with a simple keystroke.
Re: Twitter urges users to change passwords after computer 'glitch'
#155Earlier quoted context omitted.
I got forced logged and and required a password reset. That was an invalidation.
Oh, then we must have gotten different emails (the one I got was in the linked thread). I didn't know some people got something else!
Same email I got. Strange if not everyone was logged out.
Re: Twitter urges users to change passwords after computer 'glitch'
#156Actual twitter post: https://blog.twitter.com/official/en_us/topics/company/2018/... "Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again." Exact same thing that github did just recently.
So best practice would be that the cleartext password is never sent to the server, so they could never log it even accidentally. That means the hashing needs to be done client side, probably with JavaScript. Is there any safe way to do that?
nah, that just makes the "hashed password" the equivalent of the cleartext password. Whatever it is your client sends to the server for auth is the thing that needs to be protected. If the client sends a "hashed password", that's just... the password. Which now needs to be protected. Since if someone has it, they can just send it to the server for auth.
But you can do fancy cryptographic things where the server never sees the password and it's still secure. like the entire field of public key cryptography, diffie-hellman key exchange, etc.
Re: Twitter urges users to change passwords after computer 'glitch'
#157I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…
> I highly recommend using a password manager. I really wish websites would support use of client side TLS certificates as part of the authentication process. Combining that with a username and password would give you two-factor authentication.
You might want to look into the new web authentication API.
Re: Twitter urges users to change passwords after computer 'glitch'
#158I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…
I keep all my passwords in a text file. I can't imagine remembering them all. I suppose I should keep that file encrypted and synced to multiple devices with rsync or so. Would a password manager give me any advantage over this scheme?
Sync, browser integration, password generation, audits on password age and duplicates, validation against pwned passwords, shared vaults — nothing that you can't do yourself on top of a text file, if you've got the time and energy for that. TOTP, ACL, secure notes and files — these can't easily be done with a text file, but don't need to be part of a single password management system just because the commercial vendors have added these.
Re: Twitter urges users to change passwords after computer 'glitch'
#159I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…
Is there a reason to use 1Password over iCloud Keychain if you're mostly only on Apple devices?
Re: Twitter urges users to change passwords after computer 'glitch'
#160Back in my younger, move naive days when I first started using a password manager and such a practice was not as widespread, I had the same question I think most other people have: "If my computer gets hacked or infected, won't the attacker instantly grab all the passwords from the manager?" I chose to use a manager anyway, with the logic that if my system was compromised I was owned either way; memorizing passwords…
It amuses me to compare what a virus laden desktop pc looked like 10 years ago, vs what almost every major commercial/media website looks like now. They’re practically the same with all the ads and popups.