Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter urges users to change passwords after computer 'glitch'

reuters.com

Post reply on HN
Print view View original

381–390 of 490 posts

Re: Twitter urges users to change passwords after computer 'glitch'

#381

Post by laumars »

vgy7ujm wrote: post #330
bch wrote: post #283

Earlier quoted context omitted.

And consider “Yoda Notation”[0], which some people find annoying, but I found an easy hurdle to clear: if ( 3 = DEBUGLEVEL ) wouldn’t pass the the parser because you can’t assign to an rvalue. [0] https://en.wikipedia.org/wiki/Yoda_conditions

Yoda makes code more confusing to read at a glance so I would recommend against it.

I don't really see how unless you've never actually read imperative code before; either way you need to read both sides of the comparison to gauge what is being compared. I'm dyslexic and don't write my comparisons that way and still found it easy enough to read those examples at a glance.

But ultimately, even if you do find it harder to parse (for whatever reason(s)) that would only be a training thing. After a few days / weeks of writing your comparisons like that I'm sure you'll find is more jarring to read it the other way around. Like all arguments regarding coding styles, what makes the most difference is simply what you're used to reading and writing rather than actual code layout. (I say this as someone who's programmed in well over a dozen different languages over something like 30 years - you just get used to reading different coding styles after a few weeks of using it)

Re: Twitter urges users to change passwords after computer 'glitch'

#382

Post by QasimK »

u801e wrote: post #144
calebh wrote: post #99

I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…

> I highly recommend using a password manager. I really wish websites would support use of client side TLS certificates as part of the authentication process. Combining that with a username and password would give you two-factor authentication.

I looked into this and the user experience involved is very poor, in particular the browser interfaces. It sounds like a chicken-and-egg problem. On top of this, is the clear text sending of the client certificate as another poster mentioned.

Re: Twitter urges users to change passwords after computer 'glitch'

#383

Post by skolsuper »

mikesickler wrote: post #339
TomK32 wrote: post #327

Earlier quoted context omitted.

Wouldn't have happend with Rails... http://api.rubyonrails.org/classes/ActionDispatch/Http/Filte...

Of course it could have! No API is foolproof

I think the joke is that both Github and Twitter are famous for being built on Rails (although Twitter just-as-famously required a move off of Rails in order to scale)

Re: Twitter urges users to change passwords after computer 'glitch'

#384

Post by xpuente »

calebh wrote: post #99

I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…

You don't need to trust others. For example, build the password using some simple algorithm that uses the TLD name. This way you only need to remember the algorithm.

Re: Twitter urges users to change passwords after computer 'glitch'

#385

Post by baud147258 »

fixitnow wrote: post #315
Rapzid wrote: post #309

Earlier quoted context omitted.

Log review is an awesome idea. Do you mind divulging your workplace?

Log review is done for every single project at my workplace too (Walmart Labs). So I don't think this is a novel idea. And it does not stop there. Our workplace has a security risk and compliance review process which includes reviewing configuration files, data on disk, data flowing between nodes, log files, GitHub repositories, and many other artifacts to ensure that no sensitive data is being leaked anywhere. Any c…

We just realised the software I'm working on has written RSA private keys in the logs for years. Granted, it was at debug level and only when using a rarely-used functionnality, but still.

Re: Twitter urges users to change passwords after computer 'glitch'

#386

Post by baud147258 »

tigershark wrote: post #334
foo101 wrote: post #317

Earlier quoted context omitted.

I don't think "Yoda notation" is good advice. How do you prevent mistakes like the following with Yoda notation? if ( level = DEBUGLEVEL ) When both sides of the equality sign are variables, the assignment will succeed. Following Yoda notation provides a false sense of security in this case. As an experienced programmer I have written if-statements so many times in life that I never ever, even by mistake, type: if (a…

And if you write f# or Java code?

For java code, use final so that you have constants.

Re: Twitter urges users to change passwords after computer 'glitch'

#387

Post by mehrdadn »

scrollaway wrote: post #364
LgWoodenBadger wrote: post #310

Earlier quoted context omitted.

Well how do you think TOTP works?

TOTP works by having huge margins of errors (minutes worth). The original post is suggesting using time of day as seed.

The point was you could do similarly here. Just have a margin of like 30 seconds (or whatever). I never said you have to do this to nanosecond precision.

Re: Twitter urges users to change passwords after computer 'glitch'

#388

Post by zimpenfish »

inferiorhuman wrote: post #325
bigiain wrote: post #245

Earlier quoted context omitted.

We aren't. Now. (We caught ourselves doing it 4-5 months back, and went through _everything_ checking... Only random accident that brought it to the attention of anyone who bothered to question it too... Two separate instances by different devs of 'if (DEBUG_LEVEL = 3){ }' instead of == 3 - both missed by code reviews too...)

I'm curious, how often do you actually need to print out the password in a development context?

I've been working on authentication stuff for the last two weeks and the answer is "more than you'd like".

But luckily it's something we cover in code reviews and the logging mechanism has a "sensitive data filter" that defaults to on (and has an alert on it being off in production.)

Re: Twitter urges users to change passwords after computer 'glitch'

#389

Post by simias »

icebraining wrote: post #346
astura wrote: post #285

Earlier quoted context omitted.

Yeah, exactly. This error shouldn't ever happen, period. All modern development tools give big fat warnings when you do this.

This is just one of the many reasons why I like Python. > if a = 3: ^ SyntaxError: invalid syntax

Rust has an interesting take on that, it's not a syntax error to write "if a = 1 { ... }" but it'll fail to compile because the expression "a = true" returns nothing while "if" expects a boolean so it generates a type check error.

Of course a consequence of that is that you can't chained affectations (a = b = c) but it's probably a good compromise.

Re: Twitter urges users to change passwords after computer 'glitch'

#390

Post by simias »

bch wrote: post #283
jcoffland wrote: post #255

Earlier quoted context omitted.

This is why you should turn on compiler warnings and heed them. It would have caught this.

And consider “Yoda Notation”[0], which some people find annoying, but I found an easy hurdle to clear: if ( 3 = DEBUGLEVEL ) wouldn’t pass the the parser because you can’t assign to an rvalue. [0] https://en.wikipedia.org/wiki/Yoda_conditions

I know it's irrational but I really dislike Yoda notation. Every time I encounter one while reading code I have to take a small pause to understand them, I don't know why. My brain just doesn't like them. I don't think I'm the only one either, I've seen a few coding styles in the wild that explicitly disallow them.

Furthermore any decent modern compiler will warn you and ask to add an extra set of parens around assignments in conditions so I don't really think it's worth it anymore. And of course it won't save you if you're comparing two variables (while the warning will).

Post reply on HN