Live data from Hacker News

On the Twitter Hack

schneier.com

81–90 of 93 posts

Re: On the Twitter Hack

#81
post #2

I would be highly surprised if world leaders communicated anything sensitive via DM on Twitter.

Kushner reportedly texted with MBS via WhatsApp: https://www.businessinsider.com/jared-kushner-reportedly-use...

Whatsapp's messages are end to end encrypted, so in theory a compromised internal account wouldn't have access to the messages.

Its backups aren't encrypted though.

Re: On the Twitter Hack

#82
>It didn't matter whether individual accounts had a complicated and hard-to-remember password, or two-factor authentication. It didn't matter whether the accounts were normally accessed via a Mac or a PC. There was literally nothing any user could do to protect against it.

Are we sure it didn't matter? 130 accounts were targeted, but attackers only got into 45 accounts. Maybe there was a security setting that stopped the attackers from getting into the other 85.

Re: On the Twitter Hack

#83
>Were there 100 different Twitter-like companies, and enough compatibility so that all their feeds could merge into one interface, this attack wouldn't have been such a big deal.

That has its own security downsides. Now attackers don't need to find vulnerabilities in 1 specific company, they can search across 100 different companies. And each one has much less revenue so a much smaller security team.

Re: On the Twitter Hack

#84

Earlier quoted context omitted.

> If Twitter is a national security risk because people can hack it to speak in the official voice of prominent leaders, or discover state secrets through direct messages, that is nobody's fault but the government's, for relying on a platform they have no control over for official business. I don't see the government relying on it. I see public officials using it as a platform. No coordination is being done (unless i…

>Twitter is open, a private email server is not. In what way is Twitter "open"? Can I FOIA a government official's DM's? I don't see that as likely. From my standpoint, Clinton's private server is equivalent to Twitter (albeit likely less well-maintained from a security perspective). To my mind, it's wholly unacceptable for the US government to maintain secret communication platforms outside the reach of FOIA. Workin…

>In what way is Twitter "open"?

If a Tweet is posted, journalists can see it and write articles about it. Of course this doesn't apply to DMs, they are not open. I think anonbcpolitics was ignoring DMs.

Re: On the Twitter Hack

#85

Earlier quoted context omitted.

We used to have forums and blogs organised by interest topic or community. An elegant mode of organisation, for a more civilised age.

I mean, reddit and Discord are still this. They both graft on cross-community navigation and account systems for user convenience and increasing user retention.

No, they are not. Reddit (and even more so Discord) does not have the permanence that forums have and far worse tools for formatting posts, so every subreddit degenerates into 101 questions, circlejerking, and meme shit. There's no way to contain that like you can on a forum. Cross-community navigation is an anti-feature and harmful.

Re: On the Twitter Hack

#86
post #84

Earlier quoted context omitted.

>Twitter is open, a private email server is not. In what way is Twitter "open"? Can I FOIA a government official's DM's? I don't see that as likely. From my standpoint, Clinton's private server is equivalent to Twitter (albeit likely less well-maintained from a security perspective). To my mind, it's wholly unacceptable for the US government to maintain secret communication platforms outside the reach of FOIA. Workin…

>In what way is Twitter "open"? If a Tweet is posted, journalists can see it and write articles about it. Of course this doesn't apply to DMs, they are not open. I think anonbcpolitics was ignoring DMs.

I can FOIA my government's one-to-one email communication. If I can't do that w/ Twitter they shouldn't be using Twitter.

The local government I work for uses some god-awful subscription software to "archive" all their various social media interaction. I'd rather just see the government not use third-party-hosted communications systems but, grudgingly, I'll take thr "archived" social media data over nothing. The data needs to be accessible to the public, ultimately.

Re: On the Twitter Hack

#87
post #84

Earlier quoted context omitted.

>In what way is Twitter "open"? If a Tweet is posted, journalists can see it and write articles about it. Of course this doesn't apply to DMs, they are not open. I think anonbcpolitics was ignoring DMs.

I can FOIA my government's one-to-one email communication. If I can't do that w/ Twitter they shouldn't be using Twitter. The local government I work for uses some god-awful subscription software to "archive" all their various social media interaction. I'd rather just see the government not use third-party-hosted communications systems but, grudgingly, I'll take thr "archived" social media data over nothing. The data…

Shouldn't be using Twitter at all or shouldn't be using Twitter DMs?

Re: On the Twitter Hack

#88
post #84

Earlier quoted context omitted.

>Twitter is open, a private email server is not. In what way is Twitter "open"? Can I FOIA a government official's DM's? I don't see that as likely. From my standpoint, Clinton's private server is equivalent to Twitter (albeit likely less well-maintained from a security perspective). To my mind, it's wholly unacceptable for the US government to maintain secret communication platforms outside the reach of FOIA. Workin…

>In what way is Twitter "open"? If a Tweet is posted, journalists can see it and write articles about it. Of course this doesn't apply to DMs, they are not open. I think anonbcpolitics was ignoring DMs.

> I think anonbcpolitics was ignoring DMs.

Yes, because there's no evidence of anyone using DMs to govern.

We don't know if a politician uses Signal, Twitter/IG DM, or other 1:1 communication apps, we have to handle those cases when we catch them, like Hillary was caught with her private email server. If she was actually punished it may have deterred people from circumventing FOIA.

I would be directly opposed to such communication the same way I'm opposed to a private email server being used. Communicating in public tweets is entirely different though.

Re: On the Twitter Hack

#89
post #67

Earlier quoted context omitted.

If enough people opt, it is a solution. Like littering: if I throw one cigarette butt out the window, is that really an environmental hazard? No. If a hundred million people each throw 20 out the window a day, then you have a problem.

Alright, well I'm avoiding twitter as hard as I can so I guess any day now the President will stop affecting public discourse via Twitter.

You and me both. I can't tell if you're jibing, but I do think twice before clicking on links that come from certain places, which I guess is "avoiding harder". :)

Re: On the Twitter Hack

#90
post #84

Earlier quoted context omitted.

>In what way is Twitter "open"? If a Tweet is posted, journalists can see it and write articles about it. Of course this doesn't apply to DMs, they are not open. I think anonbcpolitics was ignoring DMs.

> I think anonbcpolitics was ignoring DMs. Yes, because there's no evidence of anyone using DMs to govern. We don't know if a politician uses Signal, Twitter/IG DM, or other 1:1 communication apps, we have to handle those cases when we catch them, like Hillary was caught with her private email server. If she was actually punished it may have deterred people from circumventing FOIA. I would be directly opposed to such…

In my jurisdiction, at least, the intent "to govern" doesn't make much of a difference in whether an item is a public record or not. My public records training would cause me to assume that Twitter DMs created or received by the government entity I work for, irrespective of their intent, are public records.

It would be nice if elected leaders at all levels of government were held to the law w/ respect to public records. I was absolutely outraged at the lack of law enforcement response for Clinton's private email server, just as I was outraged at the lack of response on the private email server that George W. Bush's administration allegedly maintained.

Post reply on HN