91–100 of 490 posts
I haven't actively logged into twitter in almost a year. Does this affect me?
Keeping your account secure When you set a password for your Twitter account, we use technology that masks it so no one at the company can see it. We recently identified a bug that stored passwords unmasked in an internal log. We have fixed the bug, and our investigation shows no indication of breach or misuse by anyone.
Out of an abundance of caution, we ask that you consider changing your password on all services where you’ve used this password. Learn more
Earlier quoted context omitted.
"Technology by legislation" - that's the new trend it seems. How about replacing passwords with something technologically superior instead?
Replacing passwords won’t suddenly alight large companies interests with yours.
Earlier quoted context omitted.
~~Sounds more like "we fixed this bug, and will ignore the processes that led to it happening" bullshit to me.~~
And this comment sounds more like "DAE hate twitter." Their response is acceptable and textbook. Doesn't really seem like the appropriate place to wage the battle.
1. User provides username/password.
2. An exception occurs somewhere.
3. The stack trace from the exception is logged.
4. The stack trace includes the credentials.
5. The exception ends up in a ticketing system (Trac, JIRA, etc.)
6. Nobody notices for years.Earlier quoted context omitted.
Pretty much. Apparently github did something similar and now people are curious about the library/framework. Why is it so obvious that they both used the same library?
my thoughts exactly, wondering what they are all using.
Earlier quoted context omitted.
seriously? pretty easily. somebody probably left a debug log message in place or something. guaranteed that this happens all the time and most people don't report it.
I doubt anyone left something that logged the plaintext password. No reasonable architecture necessitates holding onto a plaintext password for more than one line of code. One possibility is an HTTP server on the request path after TLS termination. But then why is an HTTP server logging the request body? My guess would be some sort of instrumentation process was blindly reading data in memory without distinguishing w…
Besides securely managing passwords, you can also use a password manager to secure your digital legacy. 1Password has a feature where you can print out "emergency kit" sheets that has the information required to access your password vault. I printed out two of these sheets and gave them to trusted family members in sealed envelopes. In the event that I become incapacitated, they will be able to access my accounts.
> The glitch was related to Twitter’s use of a technology known as “hashing” that masks passwords as a user enters them by replacing them with numbers and letters, according to the blog. Sigh. They appear to have confused hashing with asterisks. > A bug caused the passwords to be written on an internal computer log before the hashing process was completed, the blog said. So "related" in almost no way whatsoever, then…
The state of technology reporting in the mainstream press really makes me despair sometimes. The problem is that the mainstream press writes for mainstream users, and the state of science/technology understanding in the general public is the real problem.
> A bug caused passwords to be written on an internal computer log, the blog said.