Sharing is caring!

Recently an announcement by Twitter that it had uncovered and fixed a password bug that had resulted in users’ passwords being stored in plaintext in an internal log.

However, this development which caused some kind of panic, may have put over 330 million users across the globe at potential risk. To allay fears, the microblogging giant, had urged its over 330 million users across the globe to change their passwords after it discovered they were being stored “unmasked” due to a bug.
Although it said there was no indication of breach or misuse, the online news and social networking service provider in a blog post said: “When you set a password for your Twitter account, we use technology that masks it so no one at the company can see it. We recently identified a bug that stored passwords unmasked in an internal log.

“We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again,” it added. In the tweet, micro-blogging giant said that as a precaution, users should change other passwords as well if they had used the same one as their Twitter account. Although the company did not reveal how many passwords were affected, a source had told Reuters the figure was a substantial one and that passwords were left exposed for several months.
The breach comes as regulators globally scrutinize how companies store and use consumer data. Meanwhile, the European Union, according to report, would soon enforce the General Data Protection Regulation, which will include high fines for violators.
As a caution to its users, Twitter Chief Executive Officer, Jack Dorsey in a tweet message noted that, “We recently discovered a bug where account passwords were being written to an internal log before completing a masking/hashing process. We’ve fixed, see no indication of breach or misuse by anyone and believe it’s important for us to be open about this internal defect. “In a previous security incident in 2013, Twitter took the additional step of resetting passwords for impacted users. The more advisory rather than enforced approach to passwords this time around may indicate they are more confident in the lack of breach.
In that incident, they identified external hacking attempts, and a more targeted set of users. “Our investigation has thus far indicated that the attackers may have had access to limited user information – usernames, email addresses, session tokens and encrypted/salted versions of passwords – for approximately 250,000 users. As a precautionary security measure, we have reset passwords and revoked session tokens for these accounts. Even if no external breaches occurred, Twitter has previously faced questions regarding the level of access employees have to user accounts”.

Sharing is caring!