Again, from the SANS Newsbites newsletter:
–Twitter Settles FTC Privacy Charges
(June 24, 2010)
Twitter has agreed to a settlement with the US Federal Trade Commission
(FTC) over privacy issues stemming from two attacks that compromised
Twitter accounts. The FTC complaint says that Twitter’s stated privacy
policy at the time led users to believe that stronger privacy
protections were in place than were actually in use. On two separate
occasions in 2009, attackers gained unauthorized access to
administrative control of the Twitter service. In January 2009, an
attacker gained administrative access to Twitter through a brute force
dictionary attack. The intruder reset user passwords and posted some
of the passwords on a website, where others accessed them and used them
to send phony messages from those accounts. In April 2009, a Twitter
employee’s account was compromised, compromising Twitter user’s personal
information and messages sent. At the time, Twitter had no policy
against easy-to-guess administrative passwords, nor did it suspend or
disable account access after a certain number of failed log-in attempts.
Twitter has now implemented many of the FTC’s security recommendations.
The terms of the agreement prohibit Twitter from “misleading consumers
about the extent to which it maintains and protects the security,
privacy, and confidentiality of nonpublic consumer information.”
Twitter will also be required to undergo third-party security audits.
http://voices.washingtonpost.
com/posttech/2010/06/twitter_
settles_charges_by_ftc.html
http://www.wired.com/
threatlevel/2010/06/twitter-
settles-with-ftc/
http://www.msnbc.msn.com/id/
37903432/ns/technology_and_
science-security/
http://www.computerworld.com/
s/article/9178473/Twitter_
settles_FTC_privacy_complaint
[Editor's Note (Pescatore and Paller): Back in 2007 the FTC managed to
reach a similar agreement with Microsoft around questionable privacy
practices in Microsoft Passport. Notice how the FTC has managed to be
an effective regulatory agency without requiring any new laws or
regulations? Kudos to FTC.]
