.png)
Twitter advising all 330 million users to change passwords after bug exposed them in plain text
Twitter is urging all of its more than 330 million users to immediately change their passwords after a bug exposed them in plain text. While Twitter’s investigation showed that there was no evidence that any breach or misuse of the unmasked passwords occurred, the company is recommending that users change their Twitter passwords out of an “abundance of caution,” both on the site itself and anywhere else they may have used that password, which includes third-party apps like Twitterrific and TweetDeck.
According to Twitter, the bug occurred due to an issue in the hashing process that masks passwords by replacing them with a random string of characters that get stored on Twitter’s system. But due to an error with the system, apparently passwords were being saved in plain text to an internal log, instead of masking them with the hashing process. Twitter claims to have found the bug on its own and removed the passwords, in addition to working to make sure that similar issues don’t come up again.
Twitter hasn’t revealed how many users’ passwords may have potentially been compromised or how long the bug was exposing passwords before it found and fixed the issue. But the fact that the company is urging its entire user base to change their passwords indicates that it would seem to be a significant number of users.
In general, it’s worth taking some time to think about how your passwords are set up. Considering switching over to a password manager (we’ve got a great guide on how and why you should use one here) and avoiding repeating passwords across services is a good place to get started, so that when leaks like these do happen, you can avoid the worst of the damage.
via The Verge https://ift.tt/1jLudMg
May 3, 2018 at 11:31PM
Twitter is urging all of its more than 330 million users to immediately change their passwords after a bug exposed them in plain text. While Twitter’s investigation showed that there was no evidence that any breach or misuse of the unmasked passwords occurred, the company is recommending that users change their Twitter passwords out of an “abundance of caution,” both on the site itself and anywhere else they may have used that password, which includes third-party apps like Twitterrific and TweetDeck.
According to Twitter, the bug occurred due to an issue in the hashing process that masks passwords by replacing them with a random string of characters that get stored on Twitter’s system. But due to an error with the system, apparently passwords were being saved in plain text to an internal log, instead of masking them with the hashing process. Twitter claims to have found the bug on its own and removed the passwords, in addition to working to make sure that similar issues don’t come up again.
We recently found a bug that stored passwords unmasked in an internal log. We fixed the bug and have no indication of a breach or misuse by anyone. As a precaution, consider changing your password on all services where you’ve used this password. https://t.co/RyEDvQOTaZ— Twitter Support (@TwitterSupport) May 3, 2018
In general, it’s worth taking some time to think about how your passwords are set up. Considering switching over to a password manager (we’ve got a great guide on how and why you should use one here) and avoiding repeating passwords across services is a good place to get started, so that when leaks like these do happen, you can avoid the worst of the damage.
via The Verge https://ift.tt/1jLudMg
May 3, 2018 at 11:31PM
No comments:
Post a Comment