Due to their frontend architecture and how it interacts with their backend, you have no idea if they store your master password or associated encryption keys on their servers or not. They say they don’t, but they totally could and it’s impossible to prove or disprove.
What? That sounds really really bad. If that is true LastPass was an absolute security nightmare all along.
So the anonymized data might not be anonymized after all. That is as unexpected as a pot of milk boiling over on the stove when you leave the room. Expect this to be the case with all telemetry as the default. They always claim it is only for improving the products, but in reality it is very often an extremely detailed log of all user activity comprising sometimes of essentially every click and even other data about third party programs other device activity unrelated to the program or data about other devices in the same network, proximity etc. and the way your device communicates with them.
Unless software is open source and transparent about what data it collects for telemetry on a truly voluntary basis, openly asking you about whether you want to send telemetry and giving you equivalent yes and no options without any dark patterns or opt outs, always reject telemetry where possible, go into the settings and turn it off, opt out of hidden data sharing settings and block telemetry and other tracking at the network level e.g. with DNS filtering.
Supposedly anonymized data is very often not really anonymized at all. That is often just a claim to bypass privacy regulations. There are data brokers identifying supposedly anonymized data and aggregating it with other data sources for a business.
Yes, I did.
But KOSA’s chief focus is not to protect young people’s privacy. The bill’s main aim is to censor a broad swath of speech in response to concerns that young people are spending too much time on social media, and too often encountering harmful content. KOSA requires sites to “prevent and mitigate mental health disorders,” including by the promotion or exacerbation of “self-harm, suicide, eating disorders, and substance use disorders.” Make no mistake: this is a requirement that platforms censor content.
That sounds a lot like “Think of the children!” to me.
I’m going to assume that Twitch implements password hashing and salting correctly
This is not a good idea. Many many sites including major companies have terrible security and don’t spend the slightest effort in protecting user data. They simply face no consequences over it. Countless data breaches show over and over again how bad sensitive information like passwords are protected. Many sites still use ridiculously weak hashing procedures like unsalted MD5 or even store passwords in plaintext. The way many sites handle passwords not only shows that their users’ security is of absolutely no priority to them but can often only be explained with enormous incompetence. Password guidelines are often so ridiculously bad to the point where it would be a lot easier to just do it right, yet someone explicitly programed nonsensical limitations for the passwords like lenght limits, limited character sets, the necessity to start with a letter, case insensitive passwords or whatever idiocy they can think of.
Never trust a site to secure your data. They most likely won’t. Also don’t trust a companie’s report on a breach. Breaches are often kept secrete until there is no way to hide it anymore. But even then companies usually play it down and admit only to what they really cannot hide. The number and extent of known breaches is already disastrous, but there certainly is a lot of unknown breached data that makes it even worse.
We have to assume the Twitch leak is worse than they admit. The attackers might have had access to much more than we know, perhaps they were able to intercept passwords in plaintext. We also have to assume Twitch did not properly secure the saved passwords. Acting otherwise would be foolish and insecure.
Be better safe than sorry and just hit the password generate button in your password manager. If you used the same password on other sites those should be changed regardless.
And of course if your password is too weak no hashing can protect it from being cracked.
Also known as computer