Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter urges users to change passwords after computer 'glitch'

reuters.com

Post reply on HN
Print view View original

391–400 of 490 posts

Re: Twitter urges users to change passwords after computer 'glitch'

#391

Post by klackerz »

xpuente wrote: post #384
calebh wrote: post #99

I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…

You don't need to trust others. For example, build the password using some simple algorithm that uses the TLD name. This way you only need to remember the algorithm.

The problem with that is many sites have password requirements which requires password to be of a certain length and some arbitrary requirements.

Re: Twitter urges users to change passwords after computer 'glitch'

#392

Post by bartq »

oneeyedpigeon wrote: post #94

If this happens in a month's time, will they have to pay out $96,000,000 via the GDPR? This came up at my place of work the other day: are data leaks as a result of bugs breaches of the act?

they probably discovered it because were working towards being GDPR compliant.

Re: Twitter urges users to change passwords after computer 'glitch'

#393

Post by boffinism »

xpuente wrote: post #384
calebh wrote: post #99

I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…

You don't need to trust others. For example, build the password using some simple algorithm that uses the TLD name. This way you only need to remember the algorithm.

I used to use this system but moved away from it. The reason is twofold. First, if it's a simple enough algorithm there will be enough 'hash collisions' that if someone gets their hands on one of your passwords and your email address, there's a non-negligible possibility that they will be able to find another domain that has the same password.

Second, sometimes sites mandate that you change your password. Or have rules that are incompatible with that algorithm. And then you need to start remembering exceptions to your algorithm, at which point you're back where you started.

Re: Twitter urges users to change passwords after computer 'glitch'

#394

Post by overlordalex »

__jal wrote: post #183
badloginagain wrote: post #124

Earlier quoted context omitted.

I think I, and everyone here, should check as well. If capable, security-minded companies can make such a mistake, so can you.

We schedule log reviews just like we schedule backup tests. (Similar stuff gets caught during normal troubleshooting, but reviews are more comprehensive.) It only takes one debug statement leaking to prod - it has to be a process, not an event.

We also do log reviews, but 99% of the time they simply complain about the volume rather than the contents.

Do you enable debug logging in production? In our setup we log at info and above by default, but then have a config setting that lets us switch to debug logging on the fly (without a service restart).

This keeps our log volume down, while letting us troubleshoot when we need it. This also gives us an isolated time of increased logging that can be specifically audited for sensitive information.

Re: Twitter urges users to change passwords after computer 'glitch'

#396

Post by vgy7ujm »

laumars wrote: post #381
vgy7ujm wrote: post #330

Earlier quoted context omitted.

Yoda makes code more confusing to read at a glance so I would recommend against it.

I don't really see how unless you've never actually read imperative code before; either way you need to read both sides of the comparison to gauge what is being compared. I'm dyslexic and don't write my comparisons that way and still found it easy enough to read those examples at a glance. But ultimately, even if you do find it harder to parse (for whatever reason(s)) that would only be a training thing. After a few…

Consistency is king.

Often when I glance over code to understand what it is doing I don't really care about values. When scanning from left to right it is easier when the left side contains the variable names.

Also I just find it unnatural if I read it out loud. It is called Yoda for a reason.

Re: Twitter urges users to change passwords after computer 'glitch'

#397

Post by Freak_NL »

tigershark wrote: post #334
foo101 wrote: post #317

Earlier quoted context omitted.

I don't think "Yoda notation" is good advice. How do you prevent mistakes like the following with Yoda notation? if ( level = DEBUGLEVEL ) When both sides of the equality sign are variables, the assignment will succeed. Following Yoda notation provides a false sense of security in this case. As an experienced programmer I have written if-statements so many times in life that I never ever, even by mistake, type: if (a…

And if you write f# or Java code?

In Java you usually use `.equals()` to test equality, or if your argument is a boolean value:

    if (myVar) {
        //
    }
Instead of `myVar == true/false`.

The accidental assignment is much less common due to the way equality is tested in Java.

Also, `null` comparisons being assigned will fail to compile (assuming var is a String here):

    TestApp.java:6: error: incompatible types: String cannot be converted to boolean
        if (var = null) {

Re: Twitter urges users to change passwords after computer 'glitch'

#398

Post by overlordalex »

omarforgotpwd wrote: post #257
hmwhy wrote: post #254

Earlier quoted context omitted.

Genuine question—how would this bug be produced in the first place? My (limited) experience makes me think that cleartext passwords are somehow hard coded to be logged, perhaps through error logging or a feature that’s intended for testing during development. I personally would not code a backend that allows passwords (or any sensitive strings) to be logged in any shape or form in production, so it seems a little wei…

Let's say you log requests and the POST body parameters that are sent along with them. Oops, forgot to explicitly blank out and fields known to contain passwords. Now they're saved in cleartext in the logs every time the user logs in.

We made this mistake - the trick is determining what fields are sensitive, what are sensitive enough that they should be censored but included in the log, and the rest of the crud.

It turns out that this is non-trivial - when censoring how do you indicate that something was changed, while keeping the output to a minimum? blank/"null" was rejected because it would mask other problems, and "* THIS FIELD HAS BEEN REDACTED DUE TO SENSITIVE INFORMATION *" was rejected for being "too long". Currently we use "XXXXX", which has caused some intern head scratching but is otherwise fine.

Re: Twitter urges users to change passwords after computer 'glitch'

#399

Post by bad_user »

boffinism wrote: post #393
xpuente wrote: post #384

Earlier quoted context omitted.

You don't need to trust others. For example, build the password using some simple algorithm that uses the TLD name. This way you only need to remember the algorithm.

I used to use this system but moved away from it. The reason is twofold. First, if it's a simple enough algorithm there will be enough 'hash collisions' that if someone gets their hands on one of your passwords and your email address, there's a non-negligible possibility that they will be able to find another domain that has the same password. Second, sometimes sites mandate that you change your password. Or have rul…

There's also https://lesspass.com/ which is stronger than what the parent mentioned and I used a system like that for several years.

I gave up on it for the same reason. Having to remember exceptions, plus when you change your password, you have to change it everywhere, which is annoying because you can't remember every active account.

Re: Twitter urges users to change passwords after computer 'glitch'

#400

Post by ksec »

rajathagasthya wrote: post #159
calebh wrote: post #99

I highly recommend using a password manager. I finally bit the bullet and started using 1Password a few weeks ago, and I haven't looked back since. It's just so much better than having to remember a thousand different passwords. Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the inf…

Is there a reason to use 1Password over iCloud Keychain if you're mostly only on Apple devices?

My biggest problem is sometimes I switch between Mac and PC. I can't have all my website username and password locked into iCloud
Post reply on HN