Twitter is recommending its users to immediately change their passwords after the company discovered a bug that stored passwords in plain text in an internal system.
Although the company said there is no evidence passwords have been leaked or misused, it is urging its users to update their passwords as a precaution. On their blog, Twitter said:
When you set a password for your Twitter account, we use technology that masks it so no one at the company can see it. We recently identified a bug that stored passwords unmasked in an internal log. We have fixed the bug, and our investigation shows no indication of breach or misuse by anyone.
Out of an abundance of caution, we ask that you consider changing your password on all services where you’ve used this password. You can change your Twitter password anytime by going to the password settings page.
Twitter notes that it currently has no reason to believe password information ever left Twitter’s system or that these unprotected passwords were accessed by hackers, but the risk of the unknown remains.
Also, Twitter noted that hackers may utilize this current situation by inciting you to panic and letting the hackers have your password via email. Twitter states that:
If you receive any email about the need to change your password, even if it’s from Twitter. Please don’t click any links inside the email
5 comments
And how about, if Twitter itself has been hacked
Implement 2FA on all your social media accounts. Reduces the risk of your account being abused
A very big technical blunder by a big company. Makes me really consider creating a second email just to use with these social media services. Why on Mother Earth would they even have a process that saves plain passwords on file, for the why?
I wonder why you haven’t done that already
Can easily happen if no checks and balances are not put into place.
I will give you a scenario. You have a production/live issue that needs to be resolved urgently. Authentication is failing. You can’t figure why. Support/Dev Ops and Developers haven’t been able to diagnose the bug.
The big guys say, fix it urgently!
They are authorised to put in logging as an emergency change to find out exactly what is happening….Maybe the hashing isnt happening the way it’s supposed to. Maybe the salt is being corrupted in transit. Maybe authorisation/authentication is failing somewhere.
So you change and deploy a “debug” version that intercepts and logs everything plain text, so you can trace what’s happening….and eureka!…you find the source of the bug! A recent change was deployed that had a side-effect on authentication….you focus on fixing that recent change. Deploy the fix. It works! Everyone’s happy! Big guys say congrats….
…and everyone forgets that the debug logging was left in…
Happens easily. Even with checks and balances.
I’ve been developing systems for a good 18years and have seen this slip-up many places, even in payment systems where CC details ARE ACTUALLY LOGGED IN THE PLAIN TEXT…violating PCI!
Even in the best of companies, it can slip, if they don’t have processes to deal with such a unique set of variable scenarios.