Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter warns that private tweets were public for years

bbc.com

Post reply on HN
Print view View original

91–100 of 196 posts

Re: Twitter warns that private tweets were public for years

#91

Post by jerf »

I've noticed a hole in a lot of people's thinking where even if they thing to write automated testing or QA testing to ensure that a given thing is available to a certain user or role, there is often not a lot of thought given to writing tests to enure that users or roles that should not have access to the data can't get it.

I'm not sure I've ever found a permission system without explicit testing that the denials work that didn't turn out to have gaping holes in what could actually be done. Generally, the code that hides the UI for what you're not supposed to be able to do works, since that's visible, but on something like the Web where the user also has fairly direct access to the message bus the application is using to communicate to the web server, that's not enough.

Re: Twitter warns that private tweets were public for years

#92

Post by ReidZB »

alexandercrohde wrote: post #75
mrspeaker wrote: post #65

Earlier quoted context omitted.

I'm often surprised how much people share via Slack as if it's an impenetrable fortress: perfect for pasting admin passwords, keys, and incriminating opinions and business secrets... if that floodgate ever opens then it will be a crazy time for us devs!

Just as a heads up on this, slack doesn't even use HTTPS! Your employer can certainly read all private slacks on your work network, even if it's a non-work-slack workspace

Pretty sure it uses HTTPS, but if you're on a corporate network on corporate hardware, there is a real chance that there's a corporate MITM proxy that is capable of reading all of your HTTPS traffic.

Re: Twitter warns that private tweets were public for years

#93

Post by judge2020 »

alexandercrohde wrote: post #75
mrspeaker wrote: post #65

Earlier quoted context omitted.

I'm often surprised how much people share via Slack as if it's an impenetrable fortress: perfect for pasting admin passwords, keys, and incriminating opinions and business secrets... if that floodgate ever opens then it will be a crazy time for us devs!

Just as a heads up on this, slack doesn't even use HTTPS! Your employer can certainly read all private slacks on your work network, even if it's a non-work-slack workspace

    curl http://slack.com -v

Re: Twitter warns that private tweets were public for years

#94

Post by xnyanta »

clarkmoody wrote: post #49
nkkollaw wrote: post #11

Earlier quoted context omitted.

Most consumers aren't prudent. Source: see warnings on any American packaging.

American package warnings just show you how litigious the society is. Road signs. Government agency seals in front of home movies. Cookie popups on websites. All of it gets filtered out by your brain and loses effectiveness immediately.

I'm pretty sure that cookie popups are EU regulation though.

Re: Twitter warns that private tweets were public for years

#95

Post by markholmes »

tomcam wrote: post #90
Zarath wrote: post #70

Earlier quoted context omitted.

Better not be openly gay in Russia! Or openly gay 15 years ago and have them scrape old data and find out.

Or openly conservative in the USA

I’m sorry, but what? Are you suggesting that being conservative in the United States is somehow equivalent to being gay in Russia?

Re: Twitter warns that private tweets were public for years

#96

Post by lukejduncan »

bilbo0s wrote: post #9

Just my own opinion, but at this point I think it's prudent to assume that pretty much anything you send out into the digital network world is public. If it's not something you would want the world knowing you said, don't put it out there. Security breaches happen. Bugs happen. Sometimes law enforcement just comes by and says, "Give me everything that user X has ever done." In short, sh!t happens. "Everything I do on…

Definitely agree.

I remember a long time ago Facebook profile pictures used to be private. And then one day without notice they became public. For some reason, I can't find any news articles about when this happened. Maybe I'm crazy or maybe the Internet is gaslighting me. Either way, I had friends who grew up in very conservative muslim families who no longer wore the Hijab but hadn't "come out" to their parents yet. Then one day they woke up to their facebook profile pictures being public where they weren't wearing a hijab and they haven't talked to their parents since.

Anything you put online has a non-zero probability that it will be 1) hacked 2) released as a bug or 3) released as a change in policy.

Re: Twitter warns that private tweets were public for years

#97

Post by smt88 »

tomcam wrote: post #90
Zarath wrote: post #70

Earlier quoted context omitted.

Better not be openly gay in Russia! Or openly gay 15 years ago and have them scrape old data and find out.

Or openly conservative in the USA

Conservatives control our federal and most state governments. They recently had control of all three branches of the federal government.

The idea that conservatives are a disenfranchised or endangered group is absolutely ludicrous.

Re: Twitter warns that private tweets were public for years

#98

Post by marcosdumay »

odorousrex wrote: post #82
bilbo0s wrote: post #9

Just my own opinion, but at this point I think it's prudent to assume that pretty much anything you send out into the digital network world is public. If it's not something you would want the world knowing you said, don't put it out there. Security breaches happen. Bugs happen. Sometimes law enforcement just comes by and says, "Give me everything that user X has ever done." In short, sh!t happens. "Everything I do on…

This is what I have been teaching my kids and their cousins: 1) Everything you do on the internet is public 2) Everything you post on the internet is forever 3) Everything above can be traced back to you I also showed them how easy it is to save private and public snaps without sending a screenshot notification (including video!) and how easy it is to fake. It's hard to know if it's sinking in or not, but I hope so.…

All those lines would be better with ", except when you want it to" appended at the end.

Re: Twitter warns that private tweets were public for years

#99

Post by nlawalker »

VikingCoder wrote: post #55
bilbo0s wrote: post #9

Just my own opinion, but at this point I think it's prudent to assume that pretty much anything you send out into the digital network world is public. If it's not something you would want the world knowing you said, don't put it out there. Security breaches happen. Bugs happen. Sometimes law enforcement just comes by and says, "Give me everything that user X has ever done." In short, sh!t happens. "Everything I do on…

Eric Schmidt: "If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place." People have taken this different ways, but personally I think it's sage advice. We've lost our ability to keep secrets. Information wants to be free. We're terrible at digital security. Pretend everything you type into a computer is on the front page of the New York Times.

My favorite response to this is the one called out on the story a few months ago about Keybase's exploding message feature[1]:

> I have nothing to hide

> Because no one is trying to hurt you

[1] https://news.ycombinator.com/item?id=17357992

Re: Twitter warns that private tweets were public for years

#100

Post by hrktb »

bilbo0s wrote: post #9

Just my own opinion, but at this point I think it's prudent to assume that pretty much anything you send out into the digital network world is public. If it's not something you would want the world knowing you said, don't put it out there. Security breaches happen. Bugs happen. Sometimes law enforcement just comes by and says, "Give me everything that user X has ever done." In short, sh!t happens. "Everything I do on…

I think there is a line between accepting that accidents happens, and assuming that it does.

Imagine assuming that every time you cross the street you’ll get hit by a car. Assuming every time you see someone it will be the last time ever. Assuming ever day you live might be the last one.

That’s no way to live, I find it incredibly mentally taxing and insane if actually followed.

Sure security breach can happen in any service, we should still treat most of them as reasonably private for any casual use.

Post reply on HN