Twitter has managed to keep their servers safe amidst reports of attempts to hack them to gain access to user accounts. However, the company has acknowledged that it appears attacks and breaches on other web sites may have put user accounts at risk. To combat this, Twitter has taken to locking some accounts over the past few days pending owner password resets and they have posted an entry on their site with information on the current situation and tips for users.
According to Twitter, they began investigating claims that @names and related passwords were available on the “dark web.” The information appears to have been collected from breaches on other web sites or via malware installed on user machines. Combining data from different sources, hackers are then cross-referencing the data to try to build profiles of user accounts and passwords that can be tested against top sites like Twitter. They may end up being successful with these attacks if users have used the same password on multiple accounts or services.
Twitter points out that they take several actions on an ongoing, routine basis to try to keep user accounts secure. Some of these steps include things like the use of HTTPS everywhere on the site and the use of bcrypt to secure account credentials. Twitter also monitors access to accounts based on location, device being used and login history. These steps help them identify suspicious account access attempts or behavior and may trigger a lock on an account that requires a password reset.
As far as steps that end users can take, Twitter encourages users to implement two-factor authentication for their accounts. They also recommend users implement a strong password that is not used on any other web sites or services. One way to implement that second step is to use a password manager to keep track of them and generate unique passwords.