Twitter’s recommendation that all of its 330 million users around the world change their passwords highlights how jumpy and anxious companies have become around data.
Last night, Twitter urged its millions of users to change their account passwords, just to be on the safe side. The safe side of what?
Timeline for Comment wire
Twitter sent out the communications after discovering what it called a bug, i.e. an internally stored file containing user passwords written in plain text.
In a blog post, the company’s chief technology officer Parag Agrawal explained the problem and reassured users that it had been both identified and addressed.
Nevertheless, Agrawal wrote that the company is urging users to consider changing their passwords “out of an abundance of caution”.
To be clear, there was never any indication that the file of user’s account passwords in question had been misplaced, stolen, or shared with a third-party.
But the fact that it existed at all triggered the kind of mass security warning most digital communications providers would prefer not to have to deliver at all – and especially not these days, with the Facebook data privacy scandal still ongoing.
And then, Twitter bumbled the delivery.
Agrawal tweeted a message suggesting that the communication and password change recommendation sent out to users was probably surplus to requirement, but was nevertheless “the right thing to do”.
He then retracted that in a later Tweet: “I should not have said we didn’t have to share. I have felt strongly that we should. My mistake”.
I should not have said we didn’t have to share. I have felt strongly that we should. My mistake. https://t.co/Cqbs1KiUWd
— Parag Agrawal (@paraga) May 3, 2018
The State of Technology This Week
Was it, or wasn’t it, a required step?
Certainly, Twitter has a duty to inform users of all security breaches and leaks, but in this case, we’re talking about a file of plaintext passwords that was discovered somewhere within the bowels of Twitter’s IT systems.
Agrawal referred to the file as a bug. But what created it? We’ll probably never know.
What his blog post adds up to is this: We found a security loophole, and shut it down. We investigated it, and found no evidence to suggest a security breach, but all users should change their password, just in case.
In case, of what?
In case, of course, Twitter is mistaken. In case the file has already been leaked, and a hacker is teeing up those passwords to launch misinformation and communication on a new dimension: Fake news, spread over stolen but nevertheless real Twitter accounts.
Social media bot hacks work on the principle that if you put out a piece of information over enough bots, it will, at one point, be picked up by a real person, with a real account, and spread to friends and family members over social media. It’s a numbers game.
Most social media platforms, notably Twitter, have already made significant steps to identify and shut down tens of thousands of bots, and it’s now recognised that bot-driven public opinion hacking had a hand in the 2016 US Presidential elections.
With access to millions of real Twitter password accounts, tomorrow’s democracy hackers could have the ultimate follow-up.
Sure, it’s a digital doomsday scenario. But in this day and age, its one that we all – including Twitter – need to take more seriously.
So, if you wake up tomorrow to discover your Twitter account spewing a string of outrageous, inflammatory and possibly criminal views that you don’t recognise as being your own, remember: you were warned to change your password. Change it now.