Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An update on our security incident

blog.twitter.com

Post reply on HN
Print view View original

271–280 of 308 posts

Re: An update on our security incident

#271

Post by jacquesm »

basilgohar wrote: post #201
jacquesm wrote: post #189

Earlier quoted context omitted.

Just like Obama's, right?

The risk of compromise of the sitting president's account poses a much greater threat than does that of a former one. Also, the prominence of Twitter as a means for a head of state to communicate official policy came much further in prominence during the current president's term than before.

Obama has a huge following (larger than Trump in fact) and I can think of a couple of tweets by that account that would have led to some serious trouble.

Re: An update on our security incident

#272

Post by Consultant32452 »

txcwpalpha wrote: post #37
psanford wrote: post #27

Earlier quoted context omitted.

> There is a lot speculation about the identity of these 8 accounts. We will only disclose this to the impacted accounts, however to address some of the speculation: none of the eight were Verified accounts.[0] [0]: https://twitter.com/TwitterSupport/status/128433914877449830...

>none of the eight were Verified accounts. That just raises more questions for me! It would make sense if an attacker was trying to pull the data of some celebs/VIPs as an attempt to hopefully strike gold. But for them to do it on some non-verified account? That makes it seem like these specific individuals may have been targeted. If the attackers were just randomly picking accounts to download, I can't imagine them…

What if powerful people have pseudonymous accounts that are not verified?

Re: An update on our security incident

#273

Post by twic »

secfirstmd wrote: post #185
txcwpalpha wrote: post #37

Earlier quoted context omitted.

>none of the eight were Verified accounts. That just raises more questions for me! It would make sense if an attacker was trying to pull the data of some celebs/VIPs as an attempt to hopefully strike gold. But for them to do it on some non-verified account? That makes it seem like these specific individuals may have been targeted. If the attackers were just randomly picking accounts to download, I can't imagine them…

Its absolutely ridiculous that Twitter does not have end to end encryption of DMs yet. To think that they once hired Moxie/Whisper Systems and could have been miles ahead of everyone else on this. It's purely negligence at this stage.

What does this even mean? The attackers had the users' credentials, by resetting them. They had all the access the users had. There is no kind of encryption that would prevent them reading the messages in this situation.

Twitter is fundamentally a web app. Users can log in from any browser and read their messages, which are stored on the server. This is a very different situation from Signal or WhatsApp, where an account is tied to a device, and messages can be stored there.

Re: An update on our security incident

#274

Post by in_cahoots »

giarc wrote: post #244
woko wrote: post #230

Earlier quoted context omitted.

What if the 8 non-verified accounts are alt-accounts used by celebs/VIPs for personal communication? Let us imagine that I am Jeff Bezos, why would I use my official account to DM people? I would rather use one where I look like everybody so that it is less likely to be the target of an attack.

Would having access to the verified account somehow tell you what the alt account name is though?

It’s definitely possible. Boy detection will use the number of accounts coming from a single source as a signal. High-profile alt accounts are probably whitelisted so they’re not flagged by accident.

Re: An update on our security incident

#275

Post by Nightshaxx »

basilgohar wrote: post #201
jacquesm wrote: post #189

Earlier quoted context omitted.

Just like Obama's, right?

The risk of compromise of the sitting president's account poses a much greater threat than does that of a former one. Also, the prominence of Twitter as a means for a head of state to communicate official policy came much further in prominence during the current president's term than before.

Also I'd guess that hijacking the sitting President's twitter would make the hack much worse in a legal sense. Plus now you've pissed off the president who will make especially sure your life becomes he'll.

Re: An update on our security incident

#276

Post by sabas123 »

lima wrote: post #258
jnsaff2 wrote: post #191

‘ we are deliberately limiting the detail we share on our remediation steps at this time to protect their effectiveness ’ Translation - it’s not fixed. Security through obscurity. Also timeline says ‘Wednesday’ post-mortem should be accurate to the minute or second.

> Also timeline says ‘Wednesday’ post-mortem should be accurate to the minute or second. That's because it took them almost two hours to stop the attack - doesn't look good.

is two hours really that long?

Re: An update on our security incident

#277

Post by manjalyc »

fmajid wrote: post #190
tialaramex wrote: post #23

Earlier quoted context omitted.

> "passwords are hashed and salted" Means something to you and me, but means nothing to the average Twitter user who is the audience for this blog post.

Hashed and salted is insufficient, as GPUs are extremely fast at crunching through hashes. Unless they use a memory-intensive (for GPU/FPGA résistance) algorithm like argon2 or scrypt, I would assume those credentials compromised.

Doesn't matter how fast GPUs are, they only get linearly faster. Passwords are exponential in terms of difficulty so assuming your password isn't password123 no GPU in the world is going to crack a 'decent' password in a decade on any modern algorithm memory-intensive or not.

Re: An update on our security incident

#279

Post by [deleted] »

bawolff wrote: post #63
zamalek wrote: post #49

> 2FA compromised This is why sending or generating a OTP, that the user types in, is not secure. The user can be tricked into handing the OTP over the phone. Even the O365 system isn't secure (because the user can be told which number to tap over the phone). The only secure authentication these days is a non-communicable possession: Yubikey or similar. This reflects *very poorly on Twitter opsec.

very poorly is a bit much. Yes yubikey would be much better, but its not exactly standard across the industry yet. For something to reflect very poorly on twitter opsec, I would expect it to be something that is below what the average tech company was doing. e.g. There was some news article claiming [Without a whole lot of evidence] that the compromised tool used a shared password that was posted as the topic of a sl…

[deleted]
Post reply on HN