IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Twitter alerts users after squashing password revealing internal bug

The company is advising users to reset their passwords 'in the interests of caution'

The Twitter logo on a card surrounded by other cards with images such as fingerprints and locks

Twitter users are being warned to update their passwords after the company identified a flaw in its systems that could have allowed staff at the company to view them in plaintext form.

In an email sent to users, the social network explained that it had fixed the bug in question, and that its internal investigation "shows no indication of breach or misuse by anyone". However, in the interests of safety, Twitter is advising users to change their passwords just in case.

Twitter users' passwords are encrypted using the bcrypt hashing function, a widely-used encryption algorithm that is among the most secure options available. However, an error in Twitter's implementation of bcrypt could have potentially exposed users if left unchecked.

"Due to a bug, passwords were written to an internal log before completing the hashing process," the company wrote in an email to users. "We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again."

"We are very sorry this happened. We recognise and appreciate the trust you place in us, and are committed to earning that trust every day."

It's rare for large companies to be so pro-active about notifying customers of a potential security issue - particularly if it appears that no-one was affected. Most major hacks - including infamous incidents affecting Yahoo, TalkTalk and others - only come to light when evidence of the breach is discovered by a third party.

However, Twitter's behaviour is set to become the new norm. Once the new GDPR rules come into force later this month, companies will be bound by law to alert both customers and regulatory authorities in the event of a breach affecting customers' personal data, with stiff penalties for failing to do so.

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

Elon Musk offers to buy Twitter for $41.39 billion, claiming only he can 'unlock its true potential'
social media

Elon Musk offers to buy Twitter for $41.39 billion, claiming only he can 'unlock its true potential'

14 Apr 2022
Jack Dorsey admits regret for helping to centralise the internet
Network & Internet

Jack Dorsey admits regret for helping to centralise the internet

4 Apr 2022
IT Pro News In Review: Cyber attack at Ikea, Meta ordered to sell Giphy, new Twitter CEO
cyber security

IT Pro News In Review: Cyber attack at Ikea, Meta ordered to sell Giphy, new Twitter CEO

3 Dec 2021
Jack Dorsey resigns as Twitter CEO
business management

Jack Dorsey resigns as Twitter CEO

29 Nov 2021

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Russian hackers declare war on 10 countries after failed Eurovision DDoS attack
hacking

Russian hackers declare war on 10 countries after failed Eurovision DDoS attack

16 May 2022
(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security
Careers & training

(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security

17 May 2022