✉️ An update on your account security
From: info@twitter.com
Hi @willangley,
When you set a password for your Twitter account, we use technology that masks it so no one at the company can see it. We recently identified a bug that stored passwords unmasked in an internal log. We have fixed the bug, and our investigation shows no indication of breach or misuse by anyone.
Out of an abundance of caution, we ask that you consider changing your password on all services where you’ve used this password. You can change your Twitter password anytime by going to the password settings page.
…
This is a surprisingly common bug; GitHub also did this, although my password wasn’t one of the ones logged.
How did this happen? I’m not sure of the specifics. But if you’re used to working without exceptions, you can get in the rhythm of checking and logging errors after every function call that can fail:
int ret;
if (ret = bcrypt_hashpw(passwd, salt, hash)) {
syslog(LOG_ERR, "bcrypt_hashpw: got error: %d while hashing: %s \n", ret, passwd);
return ret;
}Code language: JavaScript (javascript)And sometimes you should skip the logging 😛
