Twitter has announced this Thursday the identification of a failure in their systems by which they recommend changing the password to its 336 million users . As they have explained in their blog , the error exposed the keys of their users by not hiding them properly in their internal systems.
According to the information provided by the company firsthand, the error that was identified by them has been corrected. The problem is corrected and according to the investigation they have carried out there are no signs of violation or misuse of the exposed passwords. However, the resolution of the failure does not fix the exposure of keys . That is why, “with great caution”, ask their users to consider changing their password.
In addition, if the key that has been used in Twitter has been used in other services, the request extends: users should consider changing that password wherever they have used it . It is no joke that the codes have been exposed, without any masking, even if only in the internal systems of the company.
What has failed in the systems and how to change the password of Twitter
Twitter has explained that it masks the passwords of its 336 million users through a process called hashing using a function known as bcrypt , which replaces the password in question with a random set of numbers and letters that are stored in their internal systems.
This industry standard mechanism, which allows the platform to validate credentials without revealing passwords or internally, has failed. As they explain, “passwords were written to an internal registry before completing the hashprocess . ”
Despite this exercise of transparency in the face of an improper error of a company of its size, the security managers of Twitter do not specify if all the passwords were affected , nor whether the keys were stored in plain text directly, as everything seems to point .
What is clear is that the best thing that Twitter users can do, although there is no reason according to Twitter to think that the information in the passwords has left their servers or has been misused by someone, is to change your password . To do so, simply access Settings and privacy > Password (by clicking on the link you can access directly) and on that page choose a new one.
In addition, as they also point from the company, it is advisable to activate the login verification , also known as two-factor authentication. A method that increases the security of our account.
About2ZF77
