Twitter urges users to change passwords after computer 'glitch'

Re:Twitter urges users to change passwords after computer 'g... by overlordalex on Friday May 04, 2018 @04:56AM (#16993179)

We made this mistake - the trick is determining what fields are sensitive, what are sensitive enough that they should be censored but included in the log, and the rest of the crud.

It turns out that this is non-trivial - when censoring how do you indicate that something was changed, while keeping the output to a minimum? blank/"null" was rejected because it would mask other problems, and "* THIS FIELD HAS BEEN REDACTED DUE TO SENSITIVE INFORMATION *" was rejected for being "too long". Currently we use "XXXXX", which has caused some intern head scratching but is otherwise fine.

[ Parent | on HN ]

Re:Twitter urges users to change passwords after computer 'g... by avar on Friday May 04, 2018 @05:40AM (#16993305)

Easy, you have a framework that validates & sanitizes all your parameters, don't allow any non-declared parameter, and make something like "can_be_logged" a mandatory attribute, then only log those & audit them.

[ Parent | on HN ]

Re:Twitter urges users to change passwords after computer 'g... by tbodt on Friday May 04, 2018 @07:19PM (#16999212)

I'd replace redacted fields with [redacted], or maybe U+2588

[ Parent | on HN ]

Re:Twitter urges users to change passwords after computer 'g... by amelius on Friday May 04, 2018 @08:39AM (#16994066)

You prevent a lot of these problems by hashing passwords as soon as possible (i.e., on the client).

[ Parent | on HN ]

Re:Twitter urges users to change passwords after computer 'g... by amhokies on Friday May 04, 2018 @09:02AM (#16994233)

Wouldn't that make it easier for someone that has access to hashed passwords in the case of a database leak? They would just have to submit the username and the hashed password (which they now have).

[ Parent | on HN ]

Re:Twitter urges users to change passwords after computer 'g... by etruong42 on Sunday May 06, 2018 @03:28PM (#17007964)

You're right, but the attacker won't get the user's original password that they probably reuse elsewhere.

If it's just your authentication system hashes that are compromised, the damage can be contained.

[ Parent | on HN ]

Re:Twitter urges users to change passwords after computer 'g... by jageen on Monday May 07, 2018 @10:08PM (#17018283)

In this case client side will have our algorithm (i.e in JavaScript) + private key which we will use to hash the password. If this is the case I could not see any different between giving hacker password or hash-password with algorithm and key.

[ Parent | on HN ]

Re:Twitter urges users to change passwords after computer 'g... by larkeith on Friday May 04, 2018 @09:26AM (#16994411)

While there is merit to clientside hashing, you should always hash serverside as well, lest a leak prove catastrophic.

[ Parent | on HN ]