Hacker News Reader

Comment by thezilch | Hacker News Reader

Of course, that potentially means that 250,000 user accounts were also compromised on Facebook, Pinterest, Instagram, GMail, Yahoo Mail, Hotmail, et al. If you aren't using a different password for every service or are using only a derivative of a master password (eg. hunter2@twitter, hunter2@gmail, etc), CHANGE YOUR PASSWORD on all services using the same email address (or derivatives) as your Twitter account. Setup 1Password.

View on HN

If only the salt and the hash were stolen as is being stated, and you used secure (read, non-dictionary-word-derived strings) you're probably okay even if you reused passwords.

But you shouldn't be reusing passwords anyway, of course, so go change them regardless.

And while you're at it, setup two-factor authentication on your Google account. It's a PITA, but much less of a pain than trying to get your account back.

You know, I've had this going on all four of my Gmail/Google accounts (!) for well over a year now, and I still think it's totally worth it. It's not really a pain, and I can sleep better because of it.

Yeah, I used to think it was a pain, but once I realized my email is a single point of failure it was completely worth it.

twitter passwords were salted and hashed.

Yeah, big deal; assume it's known. Change it; change any other service with something "identical." Of course, if you are smart enough to know the implications of both a strong password and salting and not using the same password, you can make your own decision, but if you are at that point, why not change it regardless?

Reply on news.ycombinator.com