Feeds

Twitter reaches settlement with feds over privacy lapses

Password sins absolved

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

Twitter has agreed to overhaul its data-security practices to settle federal charges that shoddy password policies and other lapses at the microblogging site exposed its users' private information.

Under a tentative settlement reached with the Federal Trade Commission, Twitter must establish a comprehensive information-security program that is assessed by a third party every other year for the next decade. The San Francisco-based company will also be barred from “misleading consumers about the extent to which it maintains and protects the security, privacy, and confidentiality of nonpublic consumer information,” according to a release issued Thursday.

The settlement settles charges that Twitter misled its millions of users about the safety of their private information stored on the website. The federal consumer watchdog agency also cited two lapses last year that it said contradicted those assurances. In the first one, which occurred in January, a hacker used an automated password-guessing script to obtain administrative control after flooding the website with thousands of possible phrases. He hit pay dirt when the program submitted the word “happiness,” Wired.com reported at the time.

Three months later, a separate hacker also gained administrative control of the site after first compromising a Twitter employee's personal email account, where her password was stored in the clear. At the time, Twitter encouraged employees to use their own personal accounts for work purposes and had them sign in to restricted parts of the site using the same login screen used by normal users, the FTC said.

The FTC included a litany of other security sins committed by Twitter, including allowing employees to use simple words found in the dictionary to access administrative accounts, allowing them to store them in the clear and failing to require passwords to be changed regularly.

The agreement is subject to public comment for 30 days before commissioners decide whether it should be final. A link for submissions is here. ®

Remote control for virtualized desktops

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
The total economic impact of Druva inSync
Examining the ROI enterprises may realize by implementing inSync, as they look to improve backup and recovery of endpoint data in a cost-effective manner.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Business security measures using SSL
Examines the major types of threats to information security that businesses face today and the techniques for mitigating those threats.