They so carefully avoiding mentioning how they do store passwords that I have to wonder what their security practices are on that front (and the rest). What tools are they available under? You'd think they would've said "passwords are hashed and salted" to rule it out entirely if that was a thing.
Means something to you and me, but means nothing to the average Twitter user who is the audience for this blog post.
If you use unique strong random passwords like those typically chosen by a password store (e.g. 24 alphanumerics) it doesn't matter what password hash is used, it doesn't even matter whether salt was used, because there's no chance anybody else has the same one.
For example here is simple MD5() of a password I use every day, you have no idea what it is, and even very powerful MD5 "reversing" tools won't help you change that.
f72ffd77701fba433394548eedca5fd0
Good password hashes somewhat protect people who chose bad passwords. They're a mitigation. Your users will choose bad passwords so you need to use a password hash in software you build, but if you never use bad passwords you needn't care whether this or that site used a good hash since it has no impact on your security.
Ask the average joe what it means for something to be in "plain text" and you'd probably get the answer "Oh that's simple, they didn't write it out in cursive!"
I think it most likely means, the passwords are hashed, and the hashes aren't available in this tool. There's undoubtedly other tools that allow people to view the hash, (Mysql command line client is a "tool" after all ;) Although I agree the statement is ambiguous enough, that it could mean things that aren't best practise.
The only other reference to password storage efforts: https://blog.twitter.com/en_us/a/2013/keeping-our-users-secu...
> attackers may have had access to limited user information – usernames, email addresses, session tokens and encrypted/salted versions of passwords – for approximately 250,000 users.