Repeating the same mistake over and over while expecting a different result each time is the definition of insanity. If you always do what you've done, you'll always get what you've always got.

So why do top global companies keep doing exactly that?

A Trusted Insider Took Down the President's Account

In November 2017, a Twitter contractor deactivated President Trump's account for 11 minutes, on his last day of work, using access that was supposed to be revoked within the hour. No breach, no hack, just a "trusted" employee with more reach than the company apparently realized. If an account that visible can go dark because of one person's access, changing your password isn't the lesson to take from that. The real lesson is about what insiders can do, intentionally or not, when systems are built around trusting people rather than limiting what any single person can reach.

The Password Bug That Followed

That's the backdrop for Twitter's 2018 password bug, which led to passwords being temporarily stored in plaintext internally, rather than disguised through hashing as they're supposed to be. Twitter's own blog post explained that a bug caused passwords to be written to an internal log before the hashing process completed, affecting all 330 million users, who were urged to change their passwords as a precaution.

Twitter called this a "bug" and pushed the burden of the fix onto users by telling them to update their passwords. That framing lets a company like Twitter sidestep its responsibility to fix the actual root of the problem.

Why "Change Your Password" Isn't the Fix

These platforms should be eliminating passwords, the leading cause of data breaches and identity theft, and replacing them with right-factor authentication alongside features like client-side encryption, which can offer zero-trust capabilities for users and limit how much an insider can abuse their access in the first place.

Consider Edward Snowden. He was deemed trustworthy after extensive security clearance background investigations, the kind that can cost thousands of dollars per candidate, and then worked in highly controlled facilities. Despite all of that, he was still able to access and leak information far more sensitive than anything the average person's "private" data amounts to. Most companies don't come close to that level of vetting for new hires. They trust their admins right now mostly because they haven't yet found a reason not to.

Trust Shouldn't Be the Security Model

Trust, in this sense, shouldn't be necessary in the first place. Technology should be designed to remove the need for it, to structurally prevent the opportunity for insider abuse rather than just hoping it doesn't happen. Any website or service that isn't built on a zero-trust architecture carries the risk of being misused against the very people it's supposed to protect.

Companies can say they have a zero-tolerance policy toward this kind of behavior, but they can't stop what they don't know about, and apologizing for things that should never have happened doesn't undo them.

What Client-Side Encryption and Right-Factor Authentication Actually Remove

Using features like client-side encryption and right-factor authentication removes the need to trust organizations like Facebook or Twitter to police themselves and prevent insider abuse on good faith. If a platform offers genuine zero-trust capability, it never has access to user data in a way that could compromise its users, whether that access is misused by an insider or exposed by a bug. It's also worth remembering that companies like Facebook, Twitter, and Google have built core parts of their revenue models around harvesting as much "private" data as possible and monetizing it through third parties, which is one more reason the data shouldn't be sitting somewhere a company can reach it to begin with.

It's irresponsible for a company like Twitter to keep telling users it will protect their accounts with the illusion of security that passwords provide. It's not realistic to think password changes or stronger passwords are the real solution, and it's dishonest to pretend end users aren't the ones paying for decisions the business made.

FAQ

What actually happened in Twitter's 2018 password bug?
A bug caused user passwords to be written to an internal log in plaintext, before the normal hashing process that's supposed to mask them. Twitter said the issue affected all 330 million users and urged everyone to change their passwords as a precaution.

Did an insider actually send tweets from the president's account?
No. In November 2017, a Twitter contractor deactivated the president's account for 11 minutes on his last day of work. No tweets were sent and no market impact occurred from that incident; it illustrated how much reach a single trusted insider could have, not an actual case of market manipulation.

Why doesn't changing your password fix the underlying problem?
Because the password itself, and the architecture that requires a company to store or process it at all, is the vulnerability. A new password is just as exposed to the next bug or the next insider with broad access as the old one was.

What does "zero-trust" mean in this context?
An architecture where the platform itself never has access to user data in a form that could be misused, whether by an insider or through a bug, because client-side encryption and right-factor authentication keep sensitive data out of reach by design, not by policy.

When Will Companies Learn?

So when will Twitter and companies like it actually learn? Maybe in the next "glitch" or breach that comes their way.

In the meantime, see Why Breaches Don't Surprise Me: Auth Failure for why this pattern keeps repeating, and how moving beyond usernames and passwords changes the equation.