Hacker News Reader

Comment by Alex3917 | Hacker News Reader

This is bullshit. I just got this message, and until I signed into HN I had no idea if Twitter was hacked or if there was a problem on my end. Which would be alarming, because all of my passwords are 30+ random characters, and I never reuse passwords across websites. Fuck you, Twitter.

View on HN

Just a guess here, but maybe to get the emails out to users fast they re-used an existing template that was intended for resets due to 3rd party incidents.

Even if this is true, it is very sloppy for a company the size of Twitter.

Seems to be that way.

I just got a second 'Twitter Password Reset' email with more explanatory information now, almost two and a half hours after the first.

def random_password(n):

  random_char = '1' # chosen by fair dice, guaranteed random

  return random_char * n

Just kidding. That stinks. I'm guessing your password was quite strong. Any idea how many bits of entropy it was?

It sounds like at this point Twitter sent out the email in parallel with trying to figure out how these compromises happen. Since they salt the hashed passwords, they don't know how complex your password was. Of course, you should still change your password. I changed my 80-bit Linkedin password after it was stolen.

Agree. I didn't know what was going on. I use 17 random char passwords too and the way the email is written makes it sound like I did something wrong.

What could Twitter have done better? What would you do if your users' accounts were compromised?

Where and how do you store these individual 30+ character passwords

I use lastpass, it's a great product.

Doesnt seem a great idea. When it gets hacked they get all your passwords.

is there an alternative where this is not the case?

My own solution is to have two different passwords for everything - one for banking and credit cards, another for crap like twitter/linkedin. I haven't changed my passwords for years (no point really, as you're likely to have the breaking as soon as they get your password).

I think there are risks with all solutions to the password problem.

LastPass encrypts all of the passwords client side. Assuming you use a strong enough passphrase it shouldn't matter if LastPass gets hacked.

Twitter uses bcrypt, so in theory this hack should also be nothing to worry about.

Reply on news.ycombinator.com