Hacker News Reader

Hmm, I saw this story, changed my account password(s). Then I noticed that I'd already had the email.

The email said that the password had been reset (as in dewitt's post) but I'd just logged in - after the claimed reset - with the old credentials.

That's kinda worrying.

Both my Mac and Android twitter clients are still logged in, and in the e-mail they said that session tickets had been invalidated...

These clients use a different authentication mechanism. Looks like authentication tokens for clients weren't leaked.