
Tell HN: GitHub Please Reset Your Password - tridentlead
Just received via email<p>———————-<p>Hi there,<p>During the course of regular auditing, GitHub discovered that a recently introduced bug exposed a small number of users’ passwords to our internal logging system, including yours. We have corrected this, but you&#x27;ll need to reset your password to regain access to your account.<p>GitHub stores user passwords with secure cryptographic hashes (bcrypt). However, this recently introduced bug resulted in our secure internal logs recording plaintext user passwords when users initiated a password reset. Rest assured, these passwords were not accessible to the public or other GitHub users at any time. Additionally, they were not accessible to the majority of GitHub staff and we have determined that it is very unlikely that any GitHub staff accessed these logs. GitHub does not intentionally store passwords in plaintext format. Instead, we use modern cryptographic methods to ensure passwords are stored securely in production. To note, GitHub has not been hacked or compromised in any way.<p>You can regain access to your account by resetting your password using the link below::<p>https:&#x2F;&#x2F;github.com&#x2F;password_reset<p>If you have any lingering questions or concerns about this, don&#x27;t hesitate to let us know. You can reach us by emailing support@github.com or by using our contact form:<p>https:&#x2F;&#x2F;github.com&#x2F;contact<p>Thanks,<p>GitHub Support
======
tridentlead
Seems like it’s often the side channels that get people, even when they apply
best practices to the primary system. I would be interested to know how
passwords got into a log entry though.

~~~
sgloutnikov
Just got this as well. I changed my password on GitHub about a month ago, and
it looks like only those who changed a password were affected.

If I have to guess, they maybe saved the plaintext from the form when testing
the password reset feature for some reason?

~~~
tridentlead
I also changed my password pretty recently, this seems like a good candidate
for the source of the problem.

