4 ms·
Just got the email: Your account may have been compromised by a website or service not associated with Twitter. I'd like to know how Twitter credentials w
by 0xfaded 10y ago
Just got the email:
Your account may have been compromised by a website
or service not associated with Twitter.
I'd like to know how Twitter credentials were compromised from outside Twitter.
- breakend 10y agoLike they said in the article, Twitter uses bcrypt to store your password, but many of the passwords in the dump were plain text. This suggests that they were scraped together from external sources (i.e. malware on your machine, re-use of a password from one of the other dumps like LinkedIn). Hence, compromised from outside Twitter.
- jobigoud 10y agoThey mention browser password database in the article. If true at the scale of 32M people that would be an even bigger news. Twitter may just be the beginning. Maybe the malware authors are processing and leaking the data per-website for monetization purposes? Another way would be that only a specific twitter app has been targeted by the malware.
- ryanlol 10y ago>They mention browser password database in the article. If true at the scale of 32M people that would be an even bigger news. Twitter may just be the beginning. No, it's not news at all. Anyone who's been running spyeye, zeus, whatever for a while ends up with a similar amount of logs. They don't tend to get posted publicly, but are regularly sold on various forums. 32M simultaneous installs would be a lot, 32M lifetime installs isn't.
- geofft 10y agoPassword reuse and phishing are also plausible.
- wepple 10y agoThey may've checked the password from the breach against your twitter password. If they match, they know that the password breach data could be (and will eventually) be used to access your twitter account.