Twitter is suggesting that all Twitter users update their passwords following a glitch that exposed some passwords in plaintext on its internal network.
As outlined in a blog post, Twitter says that it recently found a bug that “stored passwords unmasked in an internal log.” The bug was fixed, and an internal investigation shows that there was no breach or misuse.
We mask passwords through a process called hashing using a function known as bcrypt, which replaces the actual password with a random set of numbers and letters that are stored in Twitter’s system. This allows our systems to validate your account credentials without revealing your password. This is an industry standard.
Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again.
Despite the fact that no one appears to have accessed the plaintext passwords, Twitter is recommending that all users “consider” changing their passwords “out of an abundance of caution” both on Twitter and on any other site where the same password was used.
If you’re a Twitter user, you can change your password on the web by accessing your Twitter settings and selecting the password option. You will need to enter a current password and then choose a new one. In the Twitter iOS app, you’ll need to sign out to initiate a password change.
Using a unique password for every login is the best way to make sure you stay secure in the event of a data breach, something best managed with an app like 1Password or LastPass.
Twitter is recommending users choose a unique, strong password and then protect their accounts with two factor authentication.