Twitter Urges All Users to Change Passwords after Glitch

Today's morning start with the notification from the Twitter about the security advisory. During the internal audit Twitter confirms that due to bug in its password storage mechanisms, accidentally some users passwords (plain text) were logged in internal logs.

The same type of issue were also reported by GitHub earlier this week. GitHub also reports that its users passwords were logged in internal logs.

We recently found a bug that stored passwords unmasked in an internal log. We fixed the bug and have no indication of a breach or misuse by anyone. As a precaution, consider changing your password on all services where you’ve used this password. https://t.co/RyEDvQOTaZ

— Twitter Support (@TwitterSupport) May 3, 2018

On advisory, Twitter says that it encrypts the users passwords with the hashing function called 'bcrypt', which is one of the standard hashing function till date.

Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again. - Twitter says.

After this incident, Twitter apologize for it  and recommend its all users to immediately change their passwords.

When the issue was happened with GitHub, its notify all users via mail to change the password. But Twitter shows the advisory on homepage and ask every users to change the password.

There are more than 300 millions users on twitter, and may be every single users passwords were logged in logs. So we also recommend to change there passwords now and also to change on other side if you use same password.

What to DO?
Twitter confirms that there systems were never breached, and this happens just by a simple bug and that too internally. There is no sign or evidence of misusing.  But then also for security purpose do chnage your passwords.

• Change your password on Twitter and on any other service where you may have used the same password.
• Use a strong password that you don’t reuse on other websites.
• Enable login verification, also known as two factor authentication. This is the single best action you can take to increase your account security.
• Use a password manager to make sure you’re using strong, unique passwords everywhere.

Image: Kaspersky