Twitter Passwords Exposed: Change Yours Right Now

News
By published

Twitter said some user passwords were left 'unmasked' and that you should change yours, though we don't know how serious this really is.

Twitter announced today (May 3) that it had accidentally "unmasked" user passwords by storing them unencrypted in an internal log file.

Credit: Rizhka Nazar/Shutterstock

(Image credit: Rizhka Nazar/Shutterstock)

How long the "unmasking" lasted is crucial. If it was one day, you probably needn't worry about changing your password. If it was six months, you should consider it, just as a precaution. If the passwords lay exposed for 10 years, then you definitely need to. But as of now, Twitter isn't saying.

MORE: Here's the One Gmail Setting You Should Activate Now

The least you should do is to turn on Twitter's two-factor authentication option, or "login verification," if you haven't already. Click or tap your Twitter icon on the website or mobile app and select "Settings and Privacy" from the resulting menu. Select "Login verification" under Security on the website, or Account > Security on the mobile app, and follow the directions to set up two-factor authentication.

The website also gives you the option to "require personal information to reset your password," such as by providing an email address or a phone number, and you should choose that option.

"We recently found a bug that stored passwords unmasked in an internal log," stated a tweet from the official Twitter Support account at 4:04 pm EDT Thursday. "We fixed the bug and have no indication of a breach or misuse by anyone. As a precaution, consider changing your password on all services where you’ve used this password."

A linked blog posting explained that Twitter normally "hashes" passwords using the Bcrypt hashing algorithm, which is very strong and has never been compromised to our knowledge.

Hashes are a form of one-way encryption — input of any length results in a seemingly irreversible jumble of letters and numbers. Most online services keep hashes of user passwords instead of the passwords themselves. When you log in, whatever you enter in the password field is quickly run through the same hashing algorithm and then compared to your hashed password on file.

MORE: Essential Tips to Avoid Getting Hacked

"Due to a bug, passwords were written to an internal log before completing the hashing process," the blog posting states. "We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again."

The posting goes on to say that users should change their passwords on Twitter and anywhere else they'd use their Twitter passwords, and that the replacement password should be strong and unique. It also recommends using a password manager.

Again, we don't know how long the file with the plaintext passwords existed, so we have no idea how much risk you run if you don't change your password. The fact that Twitter suggests you do could indicate that the risk is serious — or that the company is simply covering its butt. But changing your Twitter password probably couldn't hurt.

Best Identity Protection

TOPICS
Paul Wagenseil
Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.

3 Comments Comment from the forums
  • wzis
    This is very bad: password should never be saved un-encrypted, should always saved after a one way encryption.
    Reply
  • rgd1101
    20939332 said:
    This is very bad: password should never be saved un-encrypted, should always saved after a one way encryption.

    one way encryption? you mean hash?
    Reply
  • DanIsHardWhere
    No, one-way encryption (or any type of encryption for that matter) and hashes/sslts are in no way related to each other and Tom has not confused them.
    Reply