4 ms·

My main issue is that they're not issuing a mandatory password reset for this leak, likely to save face from all their users who are completely unaware of this

• basch 8y ago
  Dont you think calling it a leak is disingenuous. Passwords were available and NO evidence points towards them being accessed. Thats a vulnerability that was not exploited, as far as they know. A leak would mean the data WAS accessed.
  • prophesi 8y ago
    The adage "Better safe than sorry" comes to mind. And a leak doesn't need evidence that it was accessed to be deemed a leak. They were stored in plaintext, potentially accessible by internal employees. That's enough to warrant a password reset. It's not asking for much. One should only entrust their password to a hashing algorithm.
    • tptacek 8y ago
      I guess if there's such a thing as an "internal leak", that's what this is. The word "leak", by itself, connotes an exposure that is not in evidence, and given the sensitivity of the topic, I think precision is called for.
      • prophesi 8y ago
        Yes, when it comes to this sort of sensitive information, there is such a thing as an internal leak. We've had PCI-compliance to ensure companies handle credit card information properly. Then we have GDPR and similar laws for personally identifying information. Access to account credentials for a large social media platform definitely falls into the sensitive & personally-identifying category.