Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> I got an email from Twitter just a few days ago stating that they'd leaked my password

Clearly you didn't read the email.

The password was potentially logged to twitter's servers in plaintext.

They have no evidence anyone collected those passwords, but various employees could, in theory, have seen those logs.

Presumably those logs are now all deleted.

Even if you didn't reset your twitter password, it's very likely you'd be fine since it's not "leaked" (to the wider internet), but could have been seen by some employees who, for fear of being fired, no doubt did not save it (and in all likelyhood didn't see it in the first place).



Assume Breach - I read an article about Microsoft's strategy in this regards. Twitter seems to follow a similar model.

https://blogs.msdn.microsoft.com/azuresecurity/2015/10/19/an...


I think his point still stands. You entrust your passwords to third parties. They don't always handle it correctly.


You obviously are more trusting than I am. Also, my point was that if Twitter messed up, so has every other website. Do you trust them all as much as you trust the Twitter employees?


You don’t trust Twitter’s story but you trust Twitter software engineers more than others?

I trust Twitter’s story about the plain text logging but don’t trust their software engineers more than others.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: