Understanding Twitter’s Security Enhancements

Understanding Twitter’s Security Enhancements

Understanding Twitter’s Security Enhancements

Last week Twitter announced a significant security enhancement – enablement of forward secrecy on twitter.com, api.twitter.com, and mobile.twitter.com domains. The prime objective of this change is to deprive hackers of an important exploitation tool.

Why was this necessary?

In the past 18 months, Twitter, akin to many other social network companies, has come under several cyber attacks by hacking community. Though not publicly acknowledged, some of them may have lead to data breaches as well. attacks-twitter

Also in between a new adversary has emerged in the form of Govt. assisted programs like NSA. It is now widely believed that such programs have collected user data without consent or knowledge of companies.

Quite naturally these social network companies are concerned about the breach of users’ privacy and data. In addition to downtime or data loss the biggest risk from such attacks is loss of reputation and the trust of millions of subscribers. No business can afford to ignore concerns of such a large number of users and hence action was imminent.

How would forward secrecy help

It is a common practice that an adversary would capture the targets network traffic and mine it for crucial information. Plain text (i.e. not encrypted) traffic can be very easily skimmed for passwords and other PIIs. So Twitter and other companies decided to switch to HTTPS which meant that network traffic was travelling in an encrypted form.

But even this was not enough especially when the company used a limited set of secret keys to encrypt the traffic. Once the adversary obtained one or more such secret keys they could de-crypt the whole traffic captured earlier. To circumvent this risk Electronic Frontier Foundation (EFF) recommended the site to implement Forward Secrecy or also known as Perfect Forward Secrecy (PFS).

In forward secrecy the session keys used by servers are truly ephemeral. Twitter implemented it by enabling the EC Diffie-Hellman cipher suite. In this scheme the client and server manage to come up with a shared, random session key without ever sending the key across the network, even under encryption.

Due to this it becomes extremely difficult (though when it comes to security nothing is impossible) to de-crypt previously captured traffic and also does not help in guessing future encryption keys.

Is this all Twitter would have done towards improving security?

The recent announcement will help strengthen user confidence and stop them from exploring other options. The EFF had recommended implementation of additional security features like HTTP Strict Transport Security; secure cookies, encryption of data center links, STARTTLS, and certificate pinning and Twitter is doing good on that front.

Forward secrecy largely affects the traffic in transit, one of the three broad areas where security lapse can occur.

Another set of changes concern end users directly. HTTPS is something that end users might have noticed on their browser. Earlier in May this year twitter introduced improved login verification using two factor authentication.  They also educate users on improved secure practices.

Finally Twitter must have taken measures for better in-house handling of data. Organization security policies and practices, cloud base backup and recovery plans and procedures or physical security come into ambit. This is something that only internal employees might have been informed about.

Does this all make Twitter future safe?

Not really. Security is always a dynamic system. Something that seems secure today may become vulnerable tomorrow. Not so long ago HTTPS alone was considered safe. These steps may be sufficient for now, but surely will get revisited in future.

Twitter thus joins other cloud companies like Facebook, Google and Dropbox in implementing these measures. With all leading cloud companies implementing it, soon this will become the default level of security.

By Manoj Tiwari

About CloudTweaks

Established in 2009, CloudTweaks is recognized as one of the leading authorities in connected technology information and services.

We embrace and instill thought leadership insights, relevant and timely news related stories, unbiased benchmark reporting as well as offer green/cleantech learning and consultive services around the world.

Our vision is to create awareness and to help find innovative ways to connect our planet in a positive eco-friendly manner.

In the meantime, you may connect with CloudTweaks by following and sharing our resources.

View All Articles

Sorry, comments are closed for this post.

Is The Fintech Industry The Next Tech Bubble?

Is The Fintech Industry The Next Tech Bubble?

The Fintech Industry Banks offered a wide variety of services such as payments, money transfers, wealth management, selling insurance, etc. over the years. While banks have expanded the number of services they offer, their core still remains credit and interest. Many experts believe that since banks offered such a wide multitude of services, they have…

Fintech Investments Are Seeing Consistent Growth

Fintech Investments Are Seeing Consistent Growth

The Financial Services Cloud Fintech investment has been seeing consistent growth in 2015, with some large moves being made this year. The infographic (Courtesy of Venturescanner) below shows the top Fintech investors and the amount of companies they’re currently funding: Just this week, a financial data startup known as Orchard Platform raised $30 million in…

The Internet of Things Lifts Off To The Cloud

The Internet of Things Lifts Off To The Cloud

The Staggering Size And Potential Of The Internet of Things Here’s a quick statistic that will blow your mind and give you a glimpse into the future. When you break that down, it translates to 127 new devices online every second. In only a decade from now, every single vehicle on earth will be connected…

Cloud Infographic – The Internet Of Things In 2020

Cloud Infographic – The Internet Of Things In 2020

The Internet Of Things In 2020 The growing interest in the Internet of Things is amongst us and there is much discussion. Attached is an archived but still relevant infographic by Intel which has produced a memorizing snapshot at how the number of connected devices have exploded since the birth of the Internet and PC.…

Digital Marketing Driven by Cloud, Big Data and IoT

Digital Marketing Driven by Cloud, Big Data and IoT

Digital Marketing Successful digital marketing campaigns are being driven largely by trending technologies, specifically the Internet of Things (IoT), Big Data, and The Cloud. These may be used for a huge number of marketing applications, from optimizing the performance of sports teams to improving science and research, even helping to aid law enforcement. Amazon Web…

Cloud Infographic – Monetizing Internet Of Things

Cloud Infographic – Monetizing Internet Of Things

Monetizing Internet Of Things There are many interesting ways in which companies are looking to connect devices to the cloud. From the vehicles to kitchen appliances the internet of things is already a $1.9 trillion dollar market based on research estimates from IDC. Included is a fascinating infographic provided by AriaSystems which shows us some of the exciting…

Big Data and Financial Services – Security Threat or Massive Opportunity?

Big Data and Financial Services – Security Threat or Massive Opportunity?

Big Data and Financial Services Cloud Banking Insights Series focuses on big data in the financial services industry and whether it is a security threat or actually a massive opportunity. How does big data fit into an overall cloud strategy? Most FI’s have a positive mind-set towards cloud IT consumption as it not only enables…

Three Factors for Choosing Your Long-term Cloud Strategy

Three Factors for Choosing Your Long-term Cloud Strategy

Choosing Your Long-term Cloud Strategy A few weeks ago I visited the global headquarters of a large multi-national company to discuss cloud strategy with the CIO. I arrived 30 minutes early and took a tour of the area where the marketing team showcased their award winning brands. I was impressed by the digital marketing strategy…

The Storytelling Machine: Big Content and Big Data

The Storytelling Machine: Big Content and Big Data

Bridging The Gap Between Big Content and Big Data Advances in cloud computing, along with the big data movement, have transformed the business IT landscape. Leveraging the cloud, companies are now afforded on demand capacity and mobile accessibility to their business-critical systems and information. At the same time, the amount of structured and unstructured data…

Four Reasons Why CIOs Must Transform IT Into ITaaS To Survive

Four Reasons Why CIOs Must Transform IT Into ITaaS To Survive

CIOs Must Transform IT The emergence of the Cloud and its three delivery models of Infrastructure as a Service (IaaS), Software as a Service (SaaS) and Platform as a Service (PaaS) has dramatically impacted and forever changed the delivery of IT services. Cloud services have pierced the veil of IT by challenging traditional method’s dominance…