Twitter warns of plain-text password gaffe

Microblogging service Twitter has warned its users to reset their passwords as soon as possible, following the discovery that it had been unwittingly logging them in plain text internally.

Storing users' passwords is, in security parlance, A Bad Idea, but services need to be able to compare a submitted password with an account password in order to allow people to log in. The solution is hashing, a one-way cryptographic function in which a string of apparent gibberish is stored in place of the password: This gibberish cannot be converted into the original password, but a submitted password can be quickly hashed and compared to the stored hash. The result: the ability to confirm whether a submitted password is correct or not without having to know the original password.

While Twitter, to its credit, approaches password use in exactly this manner, it has warned its users this week of a bug in its internal logging system which made the entire hashing process moot by writing passwords to log files in plain text format.

'Due to a bug, passwords were written to an internal log before completing the hashing process,' explains Twitter's chief technical officer Parag Agrawal in a blog post announcing the issue. 'We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again. We have fixed the bug, and our investigation shows no indication of breach or misuse by anyone.'

While there's no evidence that the plain-text passwords were ever accessed by anyone outside the company, Agrawal has nevertheless issued a call for all users to consider changing their passwords - both on Twitter itself, and on any third-party sites on which the same password was reused.

'We are very sorry this happened,' adds Agrawal. 'We recognise and appreciate the trust you place in us, and are committed to earning that trust every day.'