Hacker News Reader

Comment by simonswords82 | Hacker News Reader

I didn't need another reason to dislike Twitter but this puts another nail in their coffin, for me at least.

It seems the two platforms I derive the least amount of value from (Twitter and Linked In) are the most vulnerable to hackers and leaked passwords.

I was caught up in the Linked In password debacle recently and now have my e-mail address in the haveIbeenpwned.com database - thanks Linked In. I wonder if I'll get caught up in this mess too.

I only keep my Twitter and Linked In accounts to avoid FOMO (Fear of Missing Out) but this is making me want to shut it all down and erase every trace of personal information I have on both sites.

View on HN

RTFA.

Twitter didn't get hacked. Browser malware screen-scraped the passwords.

I did RTFA.

Do you think a typical end user is going to care the technicalities of how their password might have been leaked? I certainly don't.

The takeaway for me is that (yet) another website I entered personal information has leaked it - regardless of how this happened it further damages the trust I have for Twitter.

Had I never used Twitter all of this would be a non-event.

Please do tell me if you think I'm being illogical - I'm all ears.

It is also important to note that Russian accounts seem to be affected, which might indicate that only Russian browsers have been affected.

Furthermore, if your browser is infected, a lot worse things can happen then having your Twitter account compromised (e.g. access to your PayPal, bank and even your personal files).

True that - good points well made.

The takeaway for me is that (yet) another website I entered personal information has leaked it

Well, I think it's quite difficult to argue that. If you had a keylogger installed on your machine – apparently the case here – in what way did the website leak your personal information? Wasn't it the browser's fault?

I do think it's pretty illogical to complain about Twitter being vulnerable, if this leak was caused by screen-scraping malware in a browser. It's not something that Twitter can really defend against, beyond measures like 2FA.

Thanks for the explanation, makes sense. Still I wonder how many non-techies will simply read "Twitter hacked" and devalue the Twitter brand in their minds.

I believe you can count yourself among them :)

It is certainly technically true that if you never had a Twitter account, your Twitter password couldn't have been compromised by non-Twitter means, because you wouldn't have a Twitter password.

But that is about as useful as saying, "If I never had a bank account, then these scammers wouldn't have been able to convince me to give them access to the bank account. Now I have another reason to dislike banks!"

Bank accounts add huge amounts of value to my life. If my credit card is stolen and used fraudulently, I'm not going to revert to cash :)

Twitter, and Linked In too, have not added any value. And so when they start to become the cause of security concerns I'm going to use them as an excuse to shut my accounts on them.

It gets worse though, because I would bet that most people who do close their accounts on Twitter/Facebook/Linked In et al walk away thinking all of their data has been magically erased. I suspect that this is not the case, so the mere fact that you ever had an account on these platforms leaves you vulnerable to their security risks ad infinitum. That wouldn't be true of a bank.

> The takeaway for me is that (yet) another website I entered personal information has leaked it - regardless of how this happened it further damages the trust I have for Twitter.

I..I don't think you did. Twitter wasn't hacked. It was most likely a totally unrelated piece of malware. Users that were infected most likely have all their passwords handed over to this hacker (which means there will be more leaks to come).

I mean if anything, this is a good case against using the Firefox/Chrome password storage mechanism (which is most likely where these leaked passwords came from).

Reply on news.ycombinator.com