4 ms·
Twitter accounts hijacked in new attack
- CalmQuiet 18y agoThe Twitter response: "(Twitter co-founder Biz) Stone urged people to use strong passwords for their Twitter accounts and not to share passwords with anyone." If I were a tweeter, I'd be displeased to have the buck passed to me "for not having a strong or secret password." I'd rather have Twit accept responsibility for having missed their system's vulnerability. ...and for getting it fixed.
- tptacek 18y agoWhat evidence do you have that this was a Twitter vulnerability?
- antiform 18y agoSecurity updates like this are somewhat frustrating (disclaimer: I am a fan of full disclosure, at least after the exploit is patched). If it is able to somehow glean your Twitter password from you clicking on the link, that is a serious security risk. If users voluntarily enter their username and password, there's hardly anything one can do about it, except warn users not to enter such sensitive information haphazardly. However, I don't understand how a strong password would help in either case. Perhaps I'm overlooking another fairly obvious scenario.