This morning, along with roughly 330 million other people, I received an email from Twitter strongly suggesting that I change my password. They’re also advising that I change it on any other website I’ve ever used that password. The reason is that Twitter appears to be accidentally storing passwords in plain text. And they seem to have no idea how long it’s been happening.
Twitter has become a great way for photographers to promote their work and connect with new clients, especially commercial clients. Many nude and boudoir photographers also use it to show off their work as Twitter doesn’t have the same rules regarding image censorship as platforms like Facebook and Instagram.
Out of an abundance of caution, we ask that you consider changing your password on all services where you’ve used this password. You can change your Twitter password anytime by going to the password settings page. And they’re a large enough platform that when they suggest you change your password, you should probably listen. Although Twitter says that they have no reason to believe the plain text passwords were viewed or abused by anybody, they’re being extra cautious. The email describes the basic process of how passwords on their system are supposed to work, and what the bug was doing. Twitter has not said how many passwords have been affected or how long it’s been going on. But the BBC reports that the number is “substantial” and that they were exposed for “several months”. Due to a bug, passwords were written to an internal log before completing the hashing process. We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again. The email also offers some account security tips… So, if you use Twitter to promote your photography, make sure to change your password. Change your password on anything else that uses the same password (especially if it’s associated with the same email address). It would also be a good time to check those 3rd party apps you’ve approved on your Twitter account. Again, although we have no reason to believe password information ever left Twitter’s systems or was misused by anyone, there are a few steps you can take to help us keep your account safe: Twitter also posted a copy of the email to their blog.
