Twitter urges users to change passwords after computer 'glitch' • Hacker News Board

Re: Twitter urges users to change passwords after computer 'glitch'

#371

Post by cm2187 » Fri, May 04, 2018, 7:51 AM UTC

stingrae wrote: post #253

pishpash wrote: post #237

Earlier quoted context omitted.

But at least, with salt, it wouldn't be applicable to other sites, just one. Better to just never reuse a password though. Honestly sites should just standardize on a password changing protocol, that will go a long way towards making passwords actually disposable.

I don't think a password changing protocol would help make passwords disposable. Making people change passwords often will result in people reusing more passwords.

No the point is for password manager. The password manager would regularly reset all the password.... until someone accesses your password manager and locks you out of everything!

Re: Twitter urges users to change passwords after computer 'glitch'

#372

Post by mohitmun » Fri, May 04, 2018, 7:51 AM UTC

fatratchet wrote: post #6

Actual twitter post: https://blog.twitter.com/official/en_us/topics/company/2018/... "Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again." Exact same thing that github did just recently.

Is it there on the github blog? Any links would be appreciated

Re: Twitter urges users to change passwords after computer 'glitch'

#373

Post by anf » Fri, May 04, 2018, 7:52 AM UTC

inteleng wrote: post #362

anf wrote: post #348

Earlier quoted context omitted.

You should quit. I know you have reasons, but continuing to work at a place like this is not ethical.

Quitting is also slightly unethical.

fair point. my thoughts were that spending your time building $10 widgets and getting paid $5 by someone who is negligent with their use of people's passwords is akin to working for a company that pollutes public waters: some of your paycheck is "tainted" by the dangers you put others into, and you are smart enough to understand it. in that sense, quitting seems like a non-act, because you stop acting unethically.

I'm guessing you're referring to someone's ability to actually fix it -- in the case of logs, you can make a pretty simple regex to strip out all kinds of PII, and there really are a lot of arguments (e.g. proactively reducing cost of security audits -- if someone is reviewing your logs to figure out what happened, they might not want to see customer data).

Re: Twitter urges users to change passwords after computer 'glitch'

#374

Post by anf » Fri, May 04, 2018, 7:53 AM UTC

struppi wrote: post #370

inteleng wrote: post #362

Earlier quoted context omitted.

Quitting is also slightly unethical.

Quitting is not unethical at all. You are not required to stay with any company.

If you can prevent a company from acting unethically and you have the capacity to do so, are you not ethically obligated to try?

(switching sides of argument, I know)

Re: Twitter urges users to change passwords after computer 'glitch'

#375

Post by vincnetas » Fri, May 04, 2018, 7:54 AM UTC

foo101 wrote: post #317

bch wrote: post #283

Earlier quoted context omitted.

And consider “Yoda Notation”[0], which some people find annoying, but I found an easy hurdle to clear: if ( 3 = DEBUGLEVEL ) wouldn’t pass the the parser because you can’t assign to an rvalue. [0] https://en.wikipedia.org/wiki/Yoda_conditions

I don't think "Yoda notation" is good advice. How do you prevent mistakes like the following with Yoda notation? if ( level = DEBUGLEVEL ) When both sides of the equality sign are variables, the assignment will succeed. Following Yoda notation provides a false sense of security in this case. As an experienced programmer I have written if-statements so many times in life that I never ever, even by mistake, type: if (a…

One of the sides is(should be) a CONSTANT. And you can't assign a value to a constant.

Re: Twitter urges users to change passwords after computer 'glitch'

#376

Post by rudedogg » Fri, May 04, 2018, 7:55 AM UTC

sundvor wrote: post #151

Why should I change my "passwords"? I only have one entry for Twitch in my password manager. It's 2018, no sane person would reuse their passwords across multiple sites which can and do get hacked.

> It's 2018, no sane person would reuse their passwords across multiple sites which can and do get hacked.

All of my family does this :(. I think it's really common outside of tech savvy people. I've tried pushing them to use a password manager on their phone, or writing them down so they can use multiple passwords, but they'd rather just use a single one.

Years of bad advice didn't help either:

    - Never write your password down
    - Make sure you use at least one symbol!
    - Make sure you use one capital letter!

https://xkcd.com/936/

Re: Twitter urges users to change passwords after computer 'glitch'

#377

Post by AstralStorm » Fri, May 04, 2018, 7:59 AM UTC

cm2187 wrote: post #369

maddyboo wrote: post #278

Earlier quoted context omitted.

Perhaps implement some type of “password canary” - some type of test account(s) with known high-entropy passwords. Have an automated system send periodic login requests (or any other requests which contain sensitive information that shouldn’t be logged) for this account, and have another system which searches log files for the password. If it’s ever found, you know something is leaking.

And regularly check for that password on haveibeenpwned and other breached password databases.

Do you trust the database to not have been hijacked to capture checked passwords?

A better advice is to delete accounts you don't use. If not possible (illegal in EU now) scramble private data and the password.

Download the databases yourself and check them locally.

Changing passwords regularly also limits the damage.

Re: Twitter urges users to change passwords after computer 'glitch'

#378

Post by Leka74 » Fri, May 04, 2018, 8:02 AM UTC

tzhenghao wrote: post #264

fatratchet wrote: post #6

Actual twitter post: https://blog.twitter.com/official/en_us/topics/company/2018/... "Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again." Exact same thing that github did just recently.

Hmm why should passwords (hashed or not) be stored in logs though? I don’t see a reason for doing that. You could unset it (and/or other sensitive data) before dumping them into logs.

Probably logging the HTTP/S requests, which included usernames & passwords in plaintext.

Re: Twitter urges users to change passwords after computer 'glitch'

#379

Post by dschuetz » Fri, May 04, 2018, 8:03 AM UTC

cryptozeus wrote: post #340

dschuetz wrote: post #333

Twitter hasn't figured out how to properly handle passwords after over a decade of its existence? No, I'm not changing my password, I'm deleting my Twitter account for good. I'm tired of big shot Internet companies getting away with such bland disregard of basic security and privacy rules.

Its a mistake , it happens. Software is hard. Change your password.

It would be fine, but people who claim to be pro in software and are being paid premium refuse to learn from mistakes, neither from their own nor from others'. They just mitigate the fallout by saying things "It's was a mistake, sorry about that, it happens, software is hard".

Brain surgery is hard. Mistakes happen. But after a few mistakes you probably should stop doing brain surgery altogether. At least the patients will get a higher chance to survive your surgeries by avoiding you.

In terms of security, handling passwords should be considered analogous to brain surgery. A single mistake undermines the whole thing. If you can't handle that, stop doing it, and let people do it who can handle it better.

Re: Twitter urges users to change passwords after computer 'glitch'

#380

Post by scaryclam » Fri, May 04, 2018, 8:03 AM UTC

oneeyedpigeon wrote: post #94

If this happens in a month's time, will they have to pay out $96,000,000 via the GDPR? This came up at my place of work the other day: are data leaks as a result of bugs breaches of the act?

It would be highly unlikely that any action would be taken at all. The issue was handled responsibly and was unintentional. Fining companies who disclose problems in this manner would just cause others to try and cover them up, which would go against the intent of the GDPR (protecting users).