On Wednesday 17/2/2016 Twitter identified and has subsequently applied a fix to what it described as a “password recovery bug” that has exposed nearly 10,000 accounts on the microblogging site.
The bug affected the password recovery systems for about 24 hours. The bug had the potential to expose the email address and phone number associated with a small number of accounts (less than 10,000 active accounts). All known account holders today, so according to Twitter if you weren’t notified, you weren’t affected. Twitter commented:
We take these incidents very seriously, and we’re sorry this occurred. Any user that we find to have exploited the bug to access another account’s information will be permanently suspended, and we will also be engaging law enforcement as appropriate so they may conduct a thorough investigation and bring charges as warranted.
While this issue did not expose passwords or information that could be used directly to access an account, it serves as a reminder to us all about the importance of good account security hygiene. Some suggestions:
- Require additional information be entered in order to initiate a password reset. This feature will require that you enter your account email address or mobile number, in addition to your username, in order to send a password reset email or SMS/text.
- Be sure to use a strong password – at least 10 (but more is better) characters and a mixture of upper and lowercase letters, numbers, and symbols – that you are not using for any other accounts or sites.
- Consider using login verification. Instead of relying on just a password, login verification introduces a second check to make sure that you and only you can access your Twitter account.
- Check the Applications tab at http://twitter.com/settings/applications and revoke the access privileges of any third party applications that you do not recognize.
- If you’d like to review logins for your account you can do that at the Twitter data dashboard in your settings.
The news comes as Twitter is making tweaks to its customer service experience. For one, businesses will be able to insert a “Send a private message” link in their tweets—useful for when a business and a customer start chatting publicly about some support issue, but the business needs privace details from the person.
Twitter is also adding in new mechanisms that will allow customers to more easily give businesses measurable, consistent feedback.
“Care teams have told us they love the open-ended feedback they get from people via Tweets and Direct Messages, but they also need the ability to survey customers in a structured way to better measure and improve their service experience,” Twitter said.
