3 ms·

Assuming for a moment that what they claim is true (never attribute to malice that what can be explained by incompetence), that it is indeed a bug / password re

Assuming for a moment that what they claim is true (never attribute to malice that what can be explained by incompetence), that it is indeed a bug / password reuse, what information would you have liked them to give? It seems to me that they’re communicating they’re not hacked, looked into the issue and found nothing special. I do agree that they’re patting themselves on the back a bit too much and also should have been a bit more humble when dismissing things as password reuse.

kup0 5y ago
In general, when tech-related companies have problems like this (with potentially severe consequences), I think a post-mortem should be a minimum expectation. I just feel like the way this post frames the issue is almost like it doesn't matter that much to them. "Oops, it was just a bug, for some accounts, we think. All fixed!" just doesn't sit well with me (maybe that's a me problem...) I would want some follow-up answers, to questions like: - Why would a bug trigger alerts that are as severe as "someone else tried to use your unique not-used-elsewhere master password"? I understand bugs, even severe ones, happen- but can I trust that your alerts aren't going to cry wolf on my account going forward? - Why did you originally conclude it was credential stuffing/reuse, when there are a number of people that got the alert that clearly stated they had never used their master password anywhere else? Are you monitoring user reports / social platforms / etc to respond to and address these situations? - When you say "some" were triggered in error- does this mean some of the attempts were legitimate, or were they all due to a bug? Do you even know the answer to this question? If there are legitimate attempts on non-reused-password accounts, it appears master passwords are leaking/being captured/etc in some other way and that deserves further investigation I just want more than a sentence or two surrounded by 10+ paragraphs of "this happened because of how good we are at keeping you safe"

kup0 5y ago

In general, when tech-related companies have problems like this (with potentially severe consequences), I think a post-mortem should be a minimum expectation. I just feel like the way this post frames the issue is almost like it doesn't matter that much to them. "Oops, it was just a bug, for some accounts, we think. All fixed!" just doesn't sit well with me (maybe that's a me problem...) I would want some follow-up answers, to questions like: - Why would a bug trigger alerts that are as severe as "someone else tried to use your unique not-used-elsewhere master password"? I understand bugs, even severe ones, happen- but can I trust that your alerts aren't going to cry wolf on my account going forward? - Why did you originally conclude it was credential stuffing/reuse, when there are a number of people that got the alert that clearly stated they had never used their master password anywhere else? Are you monitoring user reports / social platforms / etc to respond to and address these situations? - When you say "some" were triggered in error- does this mean some of the attempts were legitimate, or were they all due to a bug? Do you even know the answer to this question? If there are legitimate attempts on non-reused-password accounts, it appears master passwords are leaking/being captured/etc in some other way and that deserves further investigation I just want more than a sentence or two surrounded by 10+ paragraphs of "this happened because of how good we are at keeping you safe"