4 ms·
The best part of this story is no passwords were compromised. Because Timehop deals with access tokens only, they were able to invalidate those access tokens to
by madrox 8y ago
The best part of this story is no passwords were compromised. Because Timehop deals with access tokens only, they were able to invalidate those access tokens to eliminate the risk to its users. They basically lost 21m customers by doing that, and props to them for doing the right thing.
Imagine if we still used the "enter your twitter password on our web site so we can look at your data!" anti-pattern. What a mess this would be.
Now if only we could get MFA by default on every service.
- Qwertie 8y agoYou don't need to use tokens to not have passwords leaked. Hashing has existed for a very long time.
- deleted 8y ago[deleted]
- torstenvl 8y agoThe parent post refers to access credentials held by third parties. Password hashing is of no use here unless Twitter/Facebook/whoever implemented an API that permitted you to submit a hash of the password, which they could not do unless they didn't salt their own hashes (or publicly revealed all the salts, which is effectively the same thing).
- cheeze 8y agoI guess? I mean, token based auth is nothing new at this point. I think it would be more criminally negligent not to use token auth than it is a huge success story to use it.
- tehwebguy 8y agoYeah, we are all in big trouble when Plaid or Yodlee inevitably get hacked and millions of bank passwords leak.