Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter urges users to change passwords after computer 'glitch'

reuters.com

Post reply on HN
Print view View original

301–310 of 490 posts

Re: Twitter urges users to change passwords after computer 'glitch'

#301

Post by chrischen »

peteretep wrote: post #272
chrischen wrote: post #130

Earlier quoted context omitted.

Everyone should be using a password manager. You can't really trust the average joe to be able to make secure passwords for the potentially dozens or hundreds of sites and services, and even if they do, they probably use just one secure password for everything. I just wish there was more seamless support for apps to use 1Password to paste in passwords. There are still sites that prevent pasting into password fields!

I have this fantasy that Apple starts rejecting App submissions that don't allow use of a password manager.

It's not that they don't allow the use, it's that they don't have a convenient 1Password icon next to the password field. I've noticed some apps have that. Not sure if it requires some specific integration or some open protocol.

Re: Twitter urges users to change passwords after computer 'glitch'

#303

Post by mkagenius »

astura wrote: post #285
jcoffland wrote: post #255

Earlier quoted context omitted.

This is why you should turn on compiler warnings and heed them. It would have caught this.

Yeah, exactly. This error shouldn't ever happen, period. All modern development tools give big fat warnings when you do this.

People (atleast me) ignore warnings quite often, they aren’t safe haven if you ask me.

Re: Twitter urges users to change passwords after computer 'glitch'

#304

Post by lawl »

bch wrote: post #283
jcoffland wrote: post #255

Earlier quoted context omitted.

This is why you should turn on compiler warnings and heed them. It would have caught this.

And consider “Yoda Notation”[0], which some people find annoying, but I found an easy hurdle to clear: if ( 3 = DEBUGLEVEL ) wouldn’t pass the the parser because you can’t assign to an rvalue. [0] https://en.wikipedia.org/wiki/Yoda_conditions

In this specific case DEBUGLEVEL should be a constant anyways, and thus assignment should fail, no? Also kind of denoted by being all caps.

Re: Twitter urges users to change passwords after computer 'glitch'

#305

Post by macintux »

rajathagasthya wrote: post #159
calebh wrote: post #99

I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…

Is there a reason to use 1Password over iCloud Keychain if you're mostly only on Apple devices?

I use 1Password to store everything. Security answers so I can use completely bogus ones, social security numbers for family members, software license keys, membership info, etc.

Re: Twitter urges users to change passwords after computer 'glitch'

#306

Post by mkagenius »

bch wrote: post #283
jcoffland wrote: post #255

Earlier quoted context omitted.

This is why you should turn on compiler warnings and heed them. It would have caught this.

And consider “Yoda Notation”[0], which some people find annoying, but I found an easy hurdle to clear: if ( 3 = DEBUGLEVEL ) wouldn’t pass the the parser because you can’t assign to an rvalue. [0] https://en.wikipedia.org/wiki/Yoda_conditions

Apt day for discussing Yoda condition :)

Re: Twitter urges users to change passwords after computer 'glitch'

#307

Post by md224 »

Might just be a weird coincidence, but at 2:14 PM today I got an e-mail from Twitter with the subject "Security alert: new or unusual Twitter login". I hadn't heard anything about the Twitter bug at that point (was it even public at 2:14?) but I changed my password as a response to that e-mail.

Now I'm wondering if I need to change it again... does anyone know what time the bug was patched?

Re: Twitter urges users to change passwords after computer 'glitch'

#308

Post by FPGAhacker »

astura wrote: post #285
jcoffland wrote: post #255

Earlier quoted context omitted.

This is why you should turn on compiler warnings and heed them. It would have caught this.

Yeah, exactly. This error shouldn't ever happen, period. All modern development tools give big fat warnings when you do this.

“Should” is a bad word. If you are basing a conclusion off of a “should,” you are skating on thin ice.

Re: Twitter urges users to change passwords after computer 'glitch'

#309

Post by Rapzid »

__jal wrote: post #183
badloginagain wrote: post #124

Earlier quoted context omitted.

I think I, and everyone here, should check as well. If capable, security-minded companies can make such a mistake, so can you.

We schedule log reviews just like we schedule backup tests. (Similar stuff gets caught during normal troubleshooting, but reviews are more comprehensive.) It only takes one debug statement leaking to prod - it has to be a process, not an event.

Log review is an awesome idea. Do you mind divulging your workplace?

Re: Twitter urges users to change passwords after computer 'glitch'

#310

Post by LgWoodenBadger »

hermitdev wrote: post #293
mehrdadn wrote: post #258

Earlier quoted context omitted.

The time of day is known to both the client and the server right? So they check to see that they get the same hash.

And how do you propose to do that when the clocks arent synchronized? Clock drift is exceptionally common. Not everyone runs ntp or ptp. Probably even fewer use ptp. Desktop/laptop clients it's typically configurable on whether or not to attempt clock sync, and ive never seen where the level of synchronization is documented for PCs. High precision ptp usually requires very expensive hardware, not something to be expe…

Well how do you think TOTP works?
Post reply on HN