Twitter advises users to change passwords after detecting unmasking ‘bug’

Published May 3, 2018 9:22pm ET



Twitter on Thursday advised users to change their passwords after the company detected a “bug,” which the company has since corrected.

“We recently found a bug that stored passwords unmasked in an internal log. We fixed the bug and have no indication of a breach or misuse by anyone,” Twitter said in a tweet Thursday. “As a precaution, consider changing your password on all services where you’ve used this password.”


Twitter explained in a blog post that the social media platform uses technology that masks passwords so it is invisible to those at Twitter by using “bcrypt,” which “replaces the actual password with a random set of numbers and letters that are stored in Twitter’s system.”

“Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again,” the blog post added.

While Twitter said it found the bug “recently,” it did not disclose the exact date. As of the end of 2017, Twitter had 330 million active users.

“We are very sorry this happened,” Twitter said Thursday. “We recognize and appreciate the trust you place in us, and are committed to earning that trust every day.”