Users are advised to change Twitter passwords right now

Twitter users must change passwords right away

On Thursday, Parag Agrawal, the chief Twitter technology officer has reported about a bug in the software^[1]. This flaw resulted in the recorded users' passwords in plain text.

It means if people in the company couldn't previously see the password, they now could. Likewise, such bug could lead to catastrophic consequences if the passwords would be exposed.

According to the experts, they haven't identified any misuse of the information or a breach. Although, users are advised to change the passwords on all platforms where it has been used^[2].

Now, more than 330 million users should head straight to change their Twitter passwords in order to keep their accounts safe^[3]. Fortunately, the company took corresponding measures to make sure that none of such flaws would occur in the future.

A failure in hashing process led to password record

According to the official report, Twitter used a process, called hashing to protect users' passwords. Bcrypt function replaced the password with random characters and numbers to make sure that no one could identify it^[4].

However, the passwords were recorded in plain text due to the bug:

Due to a bug, passwords were written to an internal log before completing the hashing process.

It is yet still unknown how long was the bug present before the company took measures and fixed it. Although, now the officials claim that the flaw was eliminated and users receive a pop-up with advice to change the password immediately^[5].

Learn how to change Twitter password and protect your account in the future

First, the user should change the password on Twitter by going to the password settings page. Also, if you have used the same password on other platforms — you must change it as well.

Here are some tips to help you protect your account in the future:

• Do not reuse same passwords on multiple websites;
• Make sure to use password manager which confirms how secure your password is;
• Enable two-factor authentication that requires access to your other device (e. g. phone) to receive an authentication code before logging in;
• Always use robust antivirus software to make sure that your computer is protected from malware and ransomware attacks.

The company is deeply sorry for the inconvenience it has caused:

We are very sorry this happened. We recognize and appreciate the trust you place in us, and are committed to earning that trust every day.