Twitter internal panel linked to account hijackings • Hacker News Board

Re: Twitter internal panel linked to account hijackings

#471

Post by lukeh » Fri, Jul 17, 2020, 9:26 AM UTC

ValentineC wrote: post #442

dayjah wrote: post #431

Earlier quoted context omitted.

I’ve long considered why apps don’t have some VOIP client in them; if one can Face ID into their account, and use the VOIP client to connect to a rep - then the metadata associated with the call can inform the rep you are who you say you are. Seems E* is almost there!

I may be wrong, but Face ID should be performed entirely in the SEP, and only returns a boolean.

If it only returned a Boolean, it would be impossible to design a secure network authentication protocol with it.

Re: Twitter internal panel linked to account hijackings

#472

Post by uwu » Fri, Jul 17, 2020, 1:00 PM UTC

sumon5660 wrote: post #468

owo

uwu

Re: Twitter internal panel linked to account hijackings

#473

Post by somewhatoff » Fri, Jul 17, 2020, 1:19 PM UTC

rapnie wrote: post #417

Blahah wrote: post #395

Earlier quoted context omitted.

The problem is that customers don't remember basically anything. I don't know my telephone banking password for any bank. When I call, I get asked to tell them what my last transaction was, or my mother's maiden name and DOB (public info), or what town I last used my card. I've been wrong about the recent usage questions more often than I've been right, and they say "close enough". The technological measures have to…

When I bought my house a couple years ago, I had to put my signature to make a big and urgent money transfer. The bank however didn't accept my signature for some reason, though I had been using it every time with them. It appeared that normally they not really check if it matches, but this time given the transfer amount they did. And it just so happened that the signature they had scanned in their system was the fir…

I was told that a bank would not approve a transaction because the signature I had provided in a Word document was not similar enough to the one on file.

Helpfully, they provided me with a screenshot of the one they had on file... one copy and paste later and the problem was resolved.

One copy and paste

Re: Twitter internal panel linked to account hijackings

#474

Post by edeion » Fri, Jul 17, 2020, 2:43 PM UTC

koheripbal wrote: post #464

notJim wrote: post #459

Earlier quoted context omitted.

> This is a more general and larger problem where society is constantly bending over backwards to cater to the 2% lowest performers. As your parent said, it's not 2%, it's more like everyone. No one is perfect all the time. More importantly, it's one thing when hiring, but are you seriously suggesting 2% of the population shouldn't be able to use Twitter or online banking or other online services? 140,000,000 people…

I think we need to be honest about what the most dysfunctional bottom 1-2% are costing us. ...and it's not correct to say that "everyone is imperfect sometimes" because the correlation between people who are problems across various metrics, is high.

Would you share the plans you have in store to help them cope better with our society?

Re: Twitter internal panel linked to account hijackings

#475

Post by bsev » Fri, Jul 17, 2020, 2:43 PM UTC

Interestingly, similar access was used in 2009: https://www.ftc.gov/news-events/press-releases/2010/06/twitt...

I wonder if this attack was facilitated by some security measures being relaxed to allow work from home.

Re: Twitter internal panel linked to account hijackings

#476

Post by coronadisaster » Fri, Jul 17, 2020, 5:45 PM UTC

xkcd-sucks wrote: post #155

coronadisaster wrote: post #78

Earlier quoted context omitted.

hopefully not enforceable

Anyone dumb enough to give money to a "double your bitcoins" scan deserves what they get, even if it is apparently endorsed by celebrities

Do you also think that any old person that falls for a cash scam deserves it?

Re: Twitter internal panel linked to account hijackings

#477

Post by angry_octet » Sun, Jul 19, 2020, 3:42 PM UTC

klyrs wrote: post #41

krapp wrote: post #34

Earlier quoted context omitted.

I'm starting to think web facing site admin is a bad idea. Assuming that's what this is, I don't know. But I'm surprised it's still a thing.

Is there a better solution? How do you airgap administration of a web facing service?

What part of it's administration? For example, if it's a windows machine, you control it (or it's AD PDC) with a PAW (privileged access workstation), which has to connect from a specific interface, which is not on the internet (that is, you connect via a hard line, usually via a pair of dedicated encryption devices over a point to point telco link, like ISDN/MPLS etc).

If you mean "log onto the machine and change the config" then it isn't really an air gap anymore. Usually it's a group of VMs, you change the image master (via Chef, docker etc) and boot a new instance. Ideally it's architected so most admin tasks go through an API, with auth, access control, logging, change control, etc. If you have a standardised message bus for your API you can used a Trusted Guard, aka CDS, which is a carefully designed (for high assurance, formally verified) protocol inspector designed to only allow correct protocol messages to transit. If the guard and it's ruleset pass independent analysis it is considered airgap equivalent under govt rules.