twitterlogoTwitter is suggesting that all Twitter users update their passwords following a glitch that exposed some passwords in plaintext on its internal network.

As outlined in a blog post, Twitter says that it recently found a bug that "stored passwords unmasked in an internal log." The bug was fixed, and an internal investigation shows that there was no breach or misuse.

We mask passwords through a process called hashing using a function known as bcrypt, which replaces the actual password with a random set of numbers and letters that are stored in Twitter's system. This allows our systems to validate your account credentials without revealing your password. This is an industry standard.

Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again.

Despite the fact that no one appears to have accessed the plaintext passwords, Twitter is recommending that all users "consider" changing their passwords "out of an abundance of caution" both on Twitter and on any other site where the same password was used.

If you're a Twitter user, you can change your password on the web by accessing your Twitter settings and selecting the password option. You will need to enter a current password and then choose a new one. In the Twitter iOS app, you'll need to sign out to initiate a password change.

Using a unique password for every login is the best way to make sure you stay secure in the event of a data breach, something best managed with an app like 1Password or LastPass.

Twitter is recommending users choose a unique, strong password and then protect their accounts with two factor authentication.

Tag: Twitter

Top Rated Comments

benface Avatar
41 months ago
THAT’s how you handle a situation like that.
Score: 21 Votes (Like | Disagree)
barkomatic Avatar
41 months ago
Ah, celebrities take note. For a limited time, you can claim that you didn't actually post that tweet yourself but rather someone hacked into your account due to this mistake!
Score: 14 Votes (Like | Disagree)
Porco Avatar
41 months ago
Oh no, it won't let me add a password of more than 280 characters! ;)
Score: 11 Votes (Like | Disagree)
OldSchoolMacGuy Avatar
41 months ago
All of those commenting about firing the person responsible, are completely ignorant to how the business world and technology works.

Software has bugs. There are mistakes. If you fired everyone that made a mistake, you'd set a precedent that would instill fear in everyone else. No one would want to dare make a single mistake, for fear of losing their job and thus everything grinds to a halt.

These companies have become what they are by innovating and pushing forward. You fire people for mistakes (look up the definition, I didn't say malice) then you'd either fire everyone or stop all growth and progress.

People responsible in these situations aren't fired. That's simply not how it works.
Score: 7 Votes (Like | Disagree)
dougc84 Avatar
41 months ago
My question is why the plaintext password is even sent to them for password resets. There's zero reason for that. Shouldn't it just be validated and hashed by the webpage's script before sending?
There is no hashing done by web page scripts unless the site you are on uses Javascript for both the front end and back end (such as with React, node.js, etc.). Twitter is not one of those sites. However, values are encrypted over the line due to the SSL certificate (why you see HTTPS in the browser), but those values are decrypted on the server. The web server has to handle them somehow, and certainly can't validate anything, create new records (tweets, users, etc.) or update anything (such as your user profile) if it's just garbled encryption. It is not plaintext over the line.

This is inexcusable. Which developer had the bright idea to store passwords to a log file? That should never happen, ever. There's no reason for it.
Twitter was built on Ruby on Rails. It has, I believe, since migrated to another platform, but many of the concepts still remain, regardless of framework used. In Rails, for example, everything is logged - all parameters sent from a form (login info, new tweet message, profile settings, etc.) go to the log file, as well as database transactions and manual log messages.

In real world applications, regardless of programming framework used, logging either goes to an actual file on the drive of a server, or to a drain that feeds the log line-by-line to a service (so it can be searched or you can receive alerts on errors, etc.). There are also multiple levels of logging depending on what needs priority - everything from fatal and error messages that have higher priority, to info and debug messages for general system events. Things like this would have been an info message with parameters received from a client, POSTing to a particular endpoint. Those basic info and debug messages can be omitted from production logs, which does make debugging errors more difficult, but is often done for security purposes (the "use a sledgehammer to hammer in a nail" approach).

In most cases, the application framework employs sanitizers to mask sensitive parameters from being sent to the log (i.e. passwords, credit card numbers, social security numbers, etc.). This happens in a configuration file that isn't touched often, if ever, after the application is deployed on a website. Additionally, masking sensitive parameters occurs in production but not always in local development, since building, updating, or fixing features requires a higher level of knowledge of what's going on vs. once something has gone live.

My guess is they either accidentally turned off the sanitizer, changed the password field name or are using an alias field name to prevent bots (most likely case), or never masked it in the first place and decreased the log level for debugging purposes. It's a simple mistake that isn't easily apparent.

In any case, this happened on their end, they noticed it, and they let us know. There's no indication that anything has actually been accessed. And, even still, with most accounts using 2FA, most users staying perpetually logged in, and with API keys being how external applications authenticate to your Twitter account (not with your password), the likelihood of your password even showing up in the log is very slim anyway. I'm not saying you shouldn't change your password (because you absolutely should), but this sounds much scarier than it actually is.
Score: 6 Votes (Like | Disagree)
Apple_Robert Avatar
41 months ago
I have Two Factor Authentication turned on with my Twitter account. If they had my password, it is useless to them.
Score: 5 Votes (Like | Disagree)

Top Stories

macbook air orange

Apple Developing a Whole New Kind of MacBook Air

Monday June 21, 2021 2:15 am PDT by
Apple is believed to be working on a completely new, high-end version of the MacBook Air, according to recent reports. Bloomberg's Mark Gurman, who often reveals accurate insights into Apple's plans, has repeatedly discussed the company's work on a high-end MacBook Air. Apple analyst Ming-Chi Kuo and leaker Jon Prosser have also referred to a similar MacBook Air model. The high-end...
iOS 15 Users Underwhelmed Feature

Users Underwhelmed by iOS 15 and iPadOS 15, Survey Suggests

Monday June 21, 2021 7:17 am PDT by
Users appear to be underwhelmed by Apple's upcoming iOS 15 and iPadOS 15 updates, according to the findings of a new survey by SellCell. The survey asked 3,000 iPhone and iPad users, evenly split between men and women, aged 18 or over in the United States, what they thought of iOS 15, iPadOS 15, and the naming of the upcoming iPhone 13 lineup. Over 50 percent of all of the survey's...
purple iphone 12 and 12 mini

iPhone 12 Mini Production Reportedly Ended Earlier Than Expected Due to Relatively Low Sales

Monday June 21, 2021 7:07 am PDT by
Following widespread reports that the iPhone 12 mini has experienced poor sales performance, at least relative to other iPhone 12 models, Taiwanese research firm TrendForce today claimed that production of the device has already ended. According to TrendForce, the iPhone 12 mini "reached End-of-Life ahead of time" during the second quarter of 2021, suggesting that Apple will focus on selling ...
Dark Sky App Featured

Apple Updates Dark Sky Weather App With Apple Watch Improvements and More

Tuesday June 22, 2021 11:58 am PDT by
Apple today updated the Dark Sky weather app for the first time since November with improved VoiceOver support and other bug fixes and performance improvements. In addition, Dark Sky complications on the Apple Watch now update more frequently. The full release notes for Dark Sky version 6.8.6:• Improved VoiceOver support • Complications on Apple Watch update more frequently •...
iPhone 12 v Android 2020

Apple Executive Says Users Who Want App Sideloading Already Have That Option With Other Platforms

Wednesday June 23, 2021 5:07 am PDT by
Apple earlier today published a detailed report outlining in blatant terms the negative impact that sideloading would have on the iPhone and iPad, specifically calling out the impacts it would have on user privacy and security. Now, the company is continuing its PR push, with an executive noting in an interview that users who wish to sideload apps already have that option thanks to other...
iOS Spam Calendar Feature

iCloud Users Continue to Be Plagued by Calendar Spam

Monday June 21, 2021 8:51 am PDT by
Despite previous attempts to put the situation at rest, some iCloud users continue to experience spam calendar invitations, causing their calendars to be filled with random events. The situation received widespread coverage in 2016, where Apple said that it was "actively working to address this issue" by "identifying and blocking suspicious senders." Victims are targeted in various ways. The ...
primeday2020 feature3

Amazon Prime Day: The Best Apple Deals

Monday June 21, 2021 6:15 am PDT by
Amazon's annual Prime Day event has officially kicked off today, beginning 48 hours of discounts, offers, and tons of savings across Amazon's storefront. This includes everything from home electronics to clothing, jewelry, video games, movies, and much more. Note: MacRumors is an affiliate partner with these vendors. When you click a link and make a purchase, we may receive a small payment,...
ios wifi settings

iOS Bug Causes Specific Network Name to Disable Wi-Fi on iPhones

Sunday June 20, 2021 4:15 am PDT by
A wireless network naming bug has been discovered in iOS that effectively disables an iPhone's ability to connect to Wi-Fi. Security researcher Carl Schou found that after joining a Wi-Fi network with the name "%p%s%s%s%s%n" his iPhone's Wi-Fi functionality was left "permanently disabled." Changing a hotspot's SSID did nothing to correct the problem, with even a reboot failing to make a...
iphone 13 lineup dummy models

iPhone 13 Dummy Models Depict Repositioned Camera Modules

Wednesday June 23, 2021 4:12 am PDT by
New alleged dummy models of the upcoming iPhone 13, shared by leaker Sonny Dickson on Twitter, depict a modified camera layout on the standard iPhone 13 and iPhone 13 mini, with two lenses in a diagonal arrangement rather than the vertical arrangement seen on the iPhone 12 models. The dummy models generally line up with iPhone 13 schematics previously seen by MacRumors, which showed that the ...
iphone 13 yellow

TrendForce: iPhone 13 Lineup Will Remain Limited to Maximum 512GB of Storage

Monday June 21, 2021 6:33 am PDT by
Apple will likely unveil its next-generation "iPhone 12s" or "iPhone 13" lineup in around two and a half months from now, and ahead of time, Taiwanese research firm TrendForce has outlined its expectations for the devices. A summary of TrendForce's expectations:Apple will unveil four new iPhones in September, including a mini model, a standard model, and two Pro models. September is the...