6 ms·

RTFA. Twitter didn't get hacked. Browser malware screen-scraped the passwords.

by fizx 10y ago

simonswords82 10y ago
I did RTFA. Do you think a typical end user is going to care the technicalities of how their password might have been leaked? I certainly don't. The takeaway for me is that (yet) another website I entered personal information has leaked it - regardless of how this happened it further damages the trust I have for Twitter. Had I never used Twitter all of this would be a non-event. Please do tell me if you think I'm being illogical - I'm all ears.
- Matt3o12_ 10y ago
  It is also important to note that Russian accounts seem to be affected, which might indicate that only Russian browsers have been affected. Furthermore, if your browser is infected, a lot worse things can happen then having your Twitter account compromised (e.g. access to your PayPal, bank and even your personal files).
  - simonswords82 10y ago
    True that - good points well made.
- matthewmacleod 10y ago
  The takeaway for me is that (yet) another website I entered personal information has leaked it Well, I think it's quite difficult to argue that. If you had a keylogger installed on your machine – apparently the case here – in what way did the website leak your personal information? Wasn't it the browser's fault? I do think it's pretty illogical to complain about Twitter being vulnerable, if this leak was caused by screen-scraping malware in a browser. It's not something that Twitter can really defend against, beyond measures like 2FA.
  - simonswords82 10y ago
    Thanks for the explanation, makes sense. Still I wonder how many non-techies will simply read "Twitter hacked" and devalue the Twitter brand in their minds.
    - drummer32 10y ago
      I believe you can count yourself among them :)
- geofft 10y ago
  It is certainly technically true that if you never had a Twitter account, your Twitter password couldn't have been compromised by non-Twitter means, because you wouldn't have a Twitter password. But that is about as useful as saying, "If I never had a bank account, then these scammers wouldn't have been able to convince me to give them access to the bank account. Now I have another reason to dislike banks!"
  - simonswords82 10y ago
    Bank accounts add huge amounts of value to my life. If my credit card is stolen and used fraudulently, I'm not going to revert to cash :) Twitter, and Linked In too, have not added any value. And so when they start to become the cause of security concerns I'm going to use them as an excuse to shut my accounts on them. It gets worse though, because I would bet that most people who do close their accounts on Twitter/Facebook/Linked In et al walk away thinking all of their data has been magically erased. I suspect that this is not the case, so the mere fact that you ever had an account on these platforms leaves you vulnerable to their security risks ad infinitum. That wouldn't be true of a bank.
- djsumdog 10y ago
  > The takeaway for me is that (yet) another website I entered personal information has leaked it - regardless of how this happened it further damages the trust I have for Twitter. I..I don't think you did. Twitter wasn't hacked. It was most likely a totally unrelated piece of malware. Users that were infected most likely have all their passwords handed over to this hacker (which means there will be more leaks to come). I mean if anything, this is a good case against using the Firefox/Chrome password storage mechanism (which is most likely where these leaked passwords came from).

RTFA. Twitter didn't get hacked. Browser malware screen-scraped the passwords.

by fizx 10y ago

RTFA. Twitter didn't get hacked. Browser malware screen-scraped the passwords.

I did RTFA. Do you think a typical end user is going to care the technicalities of how their password might have been leaked? I certainly don't. The takeaway for me is that (yet) another website I entered personal information has leaked it - regardless of how this happened it further damages the trust I have for Twitter. Had I never used Twitter all of this would be a non-event. Please do tell me if you think I'm being illogical - I'm all ears.

Matt3o12_ 10y ago
It is also important to note that Russian accounts seem to be affected, which might indicate that only Russian browsers have been affected. Furthermore, if your browser is infected, a lot worse things can happen then having your Twitter account compromised (e.g. access to your PayPal, bank and even your personal files).
- simonswords82 10y ago
  True that - good points well made.
matthewmacleod 10y ago
The takeaway for me is that (yet) another website I entered personal information has leaked it Well, I think it's quite difficult to argue that. If you had a keylogger installed on your machine – apparently the case here – in what way did the website leak your personal information? Wasn't it the browser's fault? I do think it's pretty illogical to complain about Twitter being vulnerable, if this leak was caused by screen-scraping malware in a browser. It's not something that Twitter can really defend against, beyond measures like 2FA.
- simonswords82 10y ago
  Thanks for the explanation, makes sense. Still I wonder how many non-techies will simply read "Twitter hacked" and devalue the Twitter brand in their minds.
  - drummer32 10y ago
    I believe you can count yourself among them :)
geofft 10y ago
It is certainly technically true that if you never had a Twitter account, your Twitter password couldn't have been compromised by non-Twitter means, because you wouldn't have a Twitter password. But that is about as useful as saying, "If I never had a bank account, then these scammers wouldn't have been able to convince me to give them access to the bank account. Now I have another reason to dislike banks!"
- simonswords82 10y ago
  Bank accounts add huge amounts of value to my life. If my credit card is stolen and used fraudulently, I'm not going to revert to cash :) Twitter, and Linked In too, have not added any value. And so when they start to become the cause of security concerns I'm going to use them as an excuse to shut my accounts on them. It gets worse though, because I would bet that most people who do close their accounts on Twitter/Facebook/Linked In et al walk away thinking all of their data has been magically erased. I suspect that this is not the case, so the mere fact that you ever had an account on these platforms leaves you vulnerable to their security risks ad infinitum. That wouldn't be true of a bank.
djsumdog 10y ago
> The takeaway for me is that (yet) another website I entered personal information has leaked it - regardless of how this happened it further damages the trust I have for Twitter. I..I don't think you did. Twitter wasn't hacked. It was most likely a totally unrelated piece of malware. Users that were infected most likely have all their passwords handed over to this hacker (which means there will be more leaks to come). I mean if anything, this is a good case against using the Firefox/Chrome password storage mechanism (which is most likely where these leaked passwords came from).