Should Watchtower warn about this?

alvaro87

Hello,

I've just read a post on Twitter blog saying this:

We recently found a bug that stored passwords unmasked in an internal log. We fixed the bug and have no indication of a breach or misuse by anyone. As a precaution, consider changing your password on all services where you’ve used this password. https://t.co/RyEDvQOTaZ

— Twitter Support (@TwitterSupport) 3 de mayo de 2018

I was wondering if, despite Twitter says they have no indication of a breach or misuse, Watchtower should warn us about this. I think it should.

What do you think?

Better safe than sorry...

Regards.

---

1Password Version: Not Provided
Extension Version: Not Provided
OS Version: Not Provided
Sync Type: Not Provided

AGAlumB

@alvaro87: This was added to Watchtower a bit before you posted this, so it may be that you hadn't yet gotten a refresh. "Better safe than sorry" is a good motto. Thanks for the heads up! :)

alvaro87

Thanks @brenty !

I can see the alert in 1Password 7 BETA for Mac and on 1Password.eu but my iOS app doesn't show anything.

Watchtower is enabled and I tried disabling and enabling again but it doesn't work. When I tap my Twitter login item, it show nothing:

iOS version: 11.3.1 (15E302).
1Password app version: 7.0.6

What could be wrong?

AGAlumB

@alvaro87: Ah, I understand what you mean now. I'm sorry for the confusion. Watchtower 2.0 is only in the 1Password.com web interface currently. The original Watchtower feature tells you about verifiable compromises, and that's not what happened with Twitter. You'll notice that Twitter is also not shown in the Watchtower section when you select that in the sidebar, only if you select your Twitter login individually. We want to let you know about the recommendation, but reserve the most explicit warnings for actual breaches. Again, I apologize that it isn't clearer.

alvaro87

@brenty : But I can see the warning in 1Password 7 Beta (Mac). If I open the app and click on Watchtower in the sidebar, my Twitter item appears with the breach warning. Why does it appear there too if it only should appear on 1Password.eu?

AGAlumB

@alvaro87: I think it's unnecessarily confusing since there are some differences between Watchtower behaviour in different places, especially with the introduction of Watchtower 2.0. We'll get this sorted out so that it's consistent everywhere. It's helpful to have this kind of notice in any case. Thanks for bringing this up! :)