Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter urges users to change passwords after computer 'glitch'

reuters.com

Post reply on HN
Print view View original

311–320 of 490 posts

Re: Twitter urges users to change passwords after computer 'glitch'

#311

Post by Rapzid »

hmwhy wrote: post #254
fatratchet wrote: post #6

Actual twitter post: https://blog.twitter.com/official/en_us/topics/company/2018/... "Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again." Exact same thing that github did just recently.

Genuine question—how would this bug be produced in the first place? My (limited) experience makes me think that cleartext passwords are somehow hard coded to be logged, perhaps through error logging or a feature that’s intended for testing during development. I personally would not code a backend that allows passwords (or any sensitive strings) to be logged in any shape or form in production, so it seems a little wei…

Your getting a lot of what I would consider bad responses.

There are ways with downsides to mitigate the risk logging requests.

HMAC with time component will render the data useless before long. Essentially OTP. Downside client time needs to be accurate.

Negotiate a shared key ala NTLM. Downside more round trips; essentially establishing encrypted transport inside encrypted transport (https).

Re: Twitter urges users to change passwords after computer 'glitch'

#312

Post by geofft »

u801e wrote: post #300
geofft wrote: post #192

Earlier quoted context omitted.

Client side TLS certificates get sent in the clear before you authenticate the server. (You can send them in a renegotiation, but renegotiation has been a historic source of both implementation and protocol security bugs because it does complicated things to TLS state.) So you don't want a client-side certificate that includes your name; that's a huge privacy leak. You could imagine a scheme where you give a user a c…

> So you don't want a client-side certificate that includes your name; that's a huge privacy leak. If it matches the username I have on a website like reddit or HN, then is it really a privacy issue? Anyone, regardless of whether they're logged in or not, can see posts I've made under my username. Though what you say can be an issue for websites where privacy from other users is expected (e.g. banks). > Today, Web Au…

They can't see that the posts are coming from your IP address, though. That's one of the things TLS protects—I can post from a coffee shop and nobody at the coffee shop can know (except perhaps by traffic analysis) that the person at the table next to them is the person with this username.

Re: Twitter urges users to change passwords after computer 'glitch'

#313

Post by carapace »

77pt77 wrote: post #9

How is something like this even possible? It just sounds so incompetent.

That's exactly what it is: incompetence, rank incompetence. Something like nine out of ten people getting paid today as professional software "engineers" should be let go. Dr. Margaret Hamilton figured out most of what we need to do to develop reliable software during and after the Apollo 11 mission. She coined the term "software engineering". Unfortunately, her work suffered from bad languaging and languished.

You'll notice you've been downvoted to hell and the comments in reply to yours are apologists and excuses. Not a coincidence.

FizzBuzz

Re: Twitter urges users to change passwords after computer 'glitch'

#314

Post by yuranlu »

jaccarmac wrote: post #251
hiccuphippo wrote: post #232

Earlier quoted context omitted.

But then you have to store the password instead of a hash of it because it would change each time thanks to the salt. A much worse situation.

You can store things as follows. Store the salted hashed password with its salt server side. When the user wants to login send them the salt and a random salt. Client side hashes the password + salt then hashes that hash with the random value. What am I missing? Probably something since this is something I rolled my own version of when I was a teenager, but it's not immediately obvious to me.

The problem with this scheme is that if database storing the salted hashed passwords is compromised, then an attacker can easily log in as any user. In a more standard setup, the attacker needs to send a valid password to log in, which is hard to reverse from the salted hashed password stored server-side. In this scheme, the attacker no longer needs to know the password, as they can just make a client that sends the compromised server hash salted with the random salt requested by the server.

Re: Twitter urges users to change passwords after computer 'glitch'

#315

Post by fixitnow »

Rapzid wrote: post #309
__jal wrote: post #183

Earlier quoted context omitted.

We schedule log reviews just like we schedule backup tests. (Similar stuff gets caught during normal troubleshooting, but reviews are more comprehensive.) It only takes one debug statement leaking to prod - it has to be a process, not an event.

Log review is an awesome idea. Do you mind divulging your workplace?

Log review is done for every single project at my workplace too (Walmart Labs). So I don't think this is a novel idea. And it does not stop there. Our workplace has a security risk and compliance review process which includes reviewing configuration files, data on disk, data flowing between nodes, log files, GitHub repositories, and many other artifacts to ensure that no sensitive data is being leaked anywhere.

Any company that deals with credit card data has to be very very sure that no sensitive data is written in clear anywhere. Even while in memory, the data needs to be hashed and the cleartext data erased as soon as possible. Per what I have heard from friends and colleagues, the other popular companies like Amazon, Twitter, Netflix, etc. also have similar processes.

Re: Twitter urges users to change passwords after computer 'glitch'

#316

Post by kdbg »

Rapzid wrote: post #309
__jal wrote: post #183

Earlier quoted context omitted.

We schedule log reviews just like we schedule backup tests. (Similar stuff gets caught during normal troubleshooting, but reviews are more comprehensive.) It only takes one debug statement leaking to prod - it has to be a process, not an event.

Log review is an awesome idea. Do you mind divulging your workplace?

For whatever its worth, I do security assessment (pentesting and the like).

Checking logs for sensitive data is a routine test when given access atleast.

Being given that access is disappointingly not routine though.

Re: Twitter urges users to change passwords after computer 'glitch'

#317

Post by foo101 »

bch wrote: post #283
jcoffland wrote: post #255

Earlier quoted context omitted.

This is why you should turn on compiler warnings and heed them. It would have caught this.

And consider “Yoda Notation”[0], which some people find annoying, but I found an easy hurdle to clear: if ( 3 = DEBUGLEVEL ) wouldn’t pass the the parser because you can’t assign to an rvalue. [0] https://en.wikipedia.org/wiki/Yoda_conditions

I don't think "Yoda notation" is good advice. How do you prevent mistakes like the following with Yoda notation?

  if ( level = DEBUGLEVEL )
When both sides of the equality sign are variables, the assignment will succeed. Following Yoda notation provides a false sense of security in this case.

As an experienced programmer I have written if-statements so many times in life that I never ever, even by mistake, type:

  if (a = b)
I always type:

  if (a == b)
by muscle memory. It has become a second nature. Unless of course where I really mean it, like:

  if ((a = b) == c)

Re: Twitter urges users to change passwords after computer 'glitch'

#318

Post by stan_rogers »

lawl wrote: post #304
bch wrote: post #283

Earlier quoted context omitted.

And consider “Yoda Notation”[0], which some people find annoying, but I found an easy hurdle to clear: if ( 3 = DEBUGLEVEL ) wouldn’t pass the the parser because you can’t assign to an rvalue. [0] https://en.wikipedia.org/wiki/Yoda_conditions

In this specific case DEBUGLEVEL should be a constant anyways, and thus assignment should fail, no? Also kind of denoted by being all caps.

Conventions cause assumptions.

Re: Twitter urges users to change passwords after computer 'glitch'

#319

Post by _sh »

mkagenius wrote: post #303
astura wrote: post #285

Earlier quoted context omitted.

Yeah, exactly. This error shouldn't ever happen, period. All modern development tools give big fat warnings when you do this.

People (atleast me) ignore warnings quite often, they aren’t safe haven if you ask me.

Hey no problem, just add -Werror to your compiler flags (C/C++/Java) or 'true' to your csproj (C#).

Re: Twitter urges users to change passwords after computer 'glitch'

#320

Post by Rapzid »

fixitnow wrote: post #315
Rapzid wrote: post #309

Earlier quoted context omitted.

Log review is an awesome idea. Do you mind divulging your workplace?

Log review is done for every single project at my workplace too (Walmart Labs). So I don't think this is a novel idea. And it does not stop there. Our workplace has a security risk and compliance review process which includes reviewing configuration files, data on disk, data flowing between nodes, log files, GitHub repositories, and many other artifacts to ensure that no sensitive data is being leaked anywhere. Any c…

It's novel to me; never worked anywhere that required high level PCI compliance or that scheduled log reviews. Adhoc log review, sure. I think it's a fantastic idea regardless of PCI compliance obligations.
Post reply on HN