Live data from Hacker News

Twitter urges users to change passwords after computer 'glitch'

reuters.com

401–410 of 490 posts

Re: Twitter urges users to change passwords after computer 'glitch'

#401

Earlier quoted context omitted.

> Last year a contractor deleted the president’s account. The fact that they undeleted it is strong evidence that he didn't have discretion in how he performed his job, and thus was actually an employee and not a contractor.

I’m not sure how that follows. Are you suggesting they don’t keep backups or use a “deletion” flag temporarily, e.g. as part of spam account removal?

Indeed. I deleted my Twitter account recently, there was a message that data is retained for 30 days to facilitate un-deletion. I assume their internal process is the same.

Re: Twitter urges users to change passwords after computer 'glitch'

#402

Earlier quoted context omitted.

I don't really see how unless you've never actually read imperative code before; either way you need to read both sides of the comparison to gauge what is being compared. I'm dyslexic and don't write my comparisons that way and still found it easy enough to read those examples at a glance. But ultimately, even if you do find it harder to parse (for whatever reason(s)) that would only be a training thing. After a few…

Consistency is king. Often when I glance over code to understand what it is doing I don't really care about values. When scanning from left to right it is easier when the left side contains the variable names. Also I just find it unnatural if I read it out loud. It is called Yoda for a reason.

But again, not of those problems you've described are unteachable. Source code itself doesn't read like how one would structure a paragraph for human consumption. But us programmers learn to parse source code because we read and write it frequently enough to learn to parse it. Just like how one might learn a human language by living and speaking in countries that speak that language.

If you've ever spent more than 5 minutes listening to arguments and counterarguments regarding Python whitespace vs C-style braces - or whether the C-style brace should append your statement for sit on its own line - then you'd quickly see that all these arguments about coding styles are really just personal preference based on what that particular developer is most used to (or pure aesthetics on what looks prettiest - that that's just a different angle of the same debate). Ultimately you were trained to read

    if (variable == value)
and thus equally you can train yourself to read

    if (value == variable)
All the reasons in the world you can't or shouldn't are just excuses to avoid retraining yourself. That's not to say I think everyone should write Yoda-style code - that's purely a matter of personal preference. But my point is arguing your preference as some tangible issue about legibility is dishonest to yourself and every other programmer.

Re: Twitter urges users to change passwords after computer 'glitch'

#403
post #285

Earlier quoted context omitted.

Yeah, exactly. This error shouldn't ever happen, period. All modern development tools give big fat warnings when you do this.

People (atleast me) ignore warnings quite often, they aren’t safe haven if you ask me.

Unless you follow a zero warning policy they are almost useless. If you have a warning that should be ignored add a pragma disable to that file. Or disable that type of warning if it's too spammy for your project.

Re: Twitter urges users to change passwords after computer 'glitch'

#404

Earlier quoted context omitted.

Let's say you log requests and the POST body parameters that are sent along with them. Oops, forgot to explicitly blank out and fields known to contain passwords. Now they're saved in cleartext in the logs every time the user logs in.

We made this mistake - the trick is determining what fields are sensitive, what are sensitive enough that they should be censored but included in the log, and the rest of the crud. It turns out that this is non-trivial - when censoring how do you indicate that something was changed, while keeping the output to a minimum? blank/"null" was rejected because it would mask other problems, and " * THIS FIELD HAS BEEN REDAC…

Easy, you have a framework that validates & sanitizes all your parameters, don't allow any non-declared parameter, and make something like "can_be_logged" a mandatory attribute, then only log those & audit them.

Re: Twitter urges users to change passwords after computer 'glitch'

#405
post #77

I haven't actively logged into twitter in almost a year. Does this affect me?

Tinfoil in me says this is exactly the point - to bring people like you back for a second chance.

Or get people to accept some change in toc/pp by/after signin-in, possibly due to GDPR pressure.

Re: Twitter urges users to change passwords after computer 'glitch'

#406

Actual twitter post: https://blog.twitter.com/official/en_us/topics/company/2018/... "Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again." Exact same thing that github did just recently.

Is it there on the github blog? Any links would be appreciated

From what I've read it only applied to a small number of users and they were notified by email.

Re: Twitter urges users to change passwords after computer 'glitch'

#407

Twitter hasn't figured out how to properly handle passwords after over a decade of its existence? No, I'm not changing my password, I'm deleting my Twitter account for good. I'm tired of big shot Internet companies getting away with such bland disregard of basic security and privacy rules.

you forgot /s at the end.

I've yet to see a company that didn't accidentally log passwords somewhere, some time.

Re: Twitter urges users to change passwords after computer 'glitch'

#408
post #349

Earlier quoted context omitted.

Not GP, but KeePass user: I store my KeePass database on a small thumb drive (SanDisk Cruzer Fit), together with a copy of the KeePass executable. If I absolutely need to decrypt my password database on someone else's machine I can take the "secure" software from the USB and hope for the best. The USB also stores a copy of Truecrypt and a large Truecrypt container with backups of my encrypted private keys (PGP, SSH).

Key logger + making a cron job that copies everything off your drive = 5 minutes of work? I hope you trust the folks you use this setup on...

Key logger + screen shots and you also get access to a 1 password account

No matter what you do if the computer you are using isn't trustworthy you're losing.

Re: Twitter urges users to change passwords after computer 'glitch'

#409

Stupid question department: W3c and IETF or other similar clever folks really like security stuff and do lots of clever things to make us safer. So why couldn't we create a http browser/server authentication method that has something closer to a nonce-based challenge/response mechanism? If it were standardized, the browsers could even do some clever hashing of some peer addresses or other things that we think should…

Mainly because the modal dialog can't be styled for security reasons, so the UI designers and marketing tools will want to style the dialog box like everyone else.

In the end user experience vs security is a straight tradeoff.

Secondly, the digest authentication only supports MD5 anyway.

Re: Twitter urges users to change passwords after computer 'glitch'

#410

Earlier quoted context omitted.

Its a mistake , it happens. Software is hard. Change your password.

It would be fine, but people who claim to be pro in software and are being paid premium refuse to learn from mistakes, neither from their own nor from others'. They just mitigate the fallout by saying things "It's was a mistake, sorry about that, it happens, software is hard". Brain surgery is hard. Mistakes happen. But after a few mistakes you probably should stop doing brain surgery altogether. At least the patient…

Paying people more doesn't prevent mistakes.

If you banned every developer the first time they made a mistake their wouldn't be any developers.

Post reply on HN