4 ms·
The worst one was at the bottom, who cares about DM - "Twitter also said that earlier this year there was a bug where log files where created with user passwor
by CryoLogic 8y ago
The worst one was at the bottom, who cares about DM -
"Twitter also said that earlier this year there was a bug where log files where created with user passwords in plaintext. Twitter urges users to change their passwords"
I mean, what type of company with over a billion dollars in VC capital stores passwords in plaintext?
- cyrusaf 8y agoIt's very unlikely they store their passwords in plaintext. They were probably logging during login requests and didn't realize the whole request body was being logged. Can happen if you have a proxy/load balancer with logging enabled.
- GhostVII 8y agoI don't think they were storing them in plain text, but on a login request it would log the request body without properly censoring the password. The password could still be hashed when it was actually put into the database.
- gizmo 8y agoThat's almost certainly a case where POST parameters get logshipped to some server for debugging purposes, and it's easy to miss something like that in an audit when you're dealing with terabytes of logfiles. Even if the logfiles are rotated every day you don't know if a developer has seen somebody's password during that window, so all passwords are assumed to be compromised.
- guessmyname 8y agoThey explained the bug here: > May 3, 2018 > Due to a bug, passwords were written to an internal log before completing > the hashing process. We found this error ourselves, removed the passwords, > and are implementing plans to prevent this bug from happening again. > — https://blog.twitter.com/official/en_us/topics/company/2018/keeping-your-account-secure.html https://blog.twitter.com/official/en_us/topics/company/2018/...