3 ms·
The "right" way to handle this is to revoke access to all logged-in devices, revoke all previous passwords, send an email notifying users of the revocations, an
by uptown 9y ago
The "right" way to handle this is to revoke access to all logged-in devices, revoke all previous passwords, send an email notifying users of the revocations, and force a password change upon next login. But Twitter won't do that because a non-trivial percentage of their user base would never jump through the hoops to get things up and running again and Twitter's MAU numbers would sink.
- 49bc 9y agoThis doesn’t make a big impact in the end because of how prevalent password reuse is.
- quickthrower2 9y agoThis is an opportunity to run Troy's filter on the new password.
- sneak 9y agoThat that is “right” is subjective. Twitter isn’t banking or ATC or healthcare.
- jedimastert 9y agoTrue, but I could see a lot of livelihoods and careers being ruined by a malicious tweet.
- zeroxfe 9y ago> The "right" way to handle this ... maybe in a vacuum. It's possible that if you had all the facts, you just might agree with their course of action.
- billysielu 9y agoI think the risk from phishing as a result of this news is higher than the risk from the issue itself.