Parler Databases Disclosed • Hacker News Board

Re: Parler Databases Disclosed

#21

Post by atemerev » Mon, Jan 11, 2021, 10:02 AM UTC

Oh come on, it was a honeypot from the beginning.

Everybody in the last few days was talking about Parler -- they got more exposure than ever in their life. The takedown from AWS was announced a few days before, so more users could register. Parler was running a "Verified Parler citizen" (wat?) campaign, to gather more personal data. And now, hackers conveniently exposed everything. Hackers are unpredictable, you know.

I am not defending the Parler audience; the honeypot was elegant, but is it ethical?

Re: Parler Databases Disclosed

#22

Post by jedimastert » Mon, Jan 11, 2021, 10:07 AM UTC

aidenn0 wrote: post #7

osgovernment wrote: post #3

If you're not signed up as a foster/adoptive parent, now is a good time if you want to have an impact. There are going to be a lot of kids flooding into the system from families that felt emboldened to become domestic terrorists by the President and those he surrounds himself with.

Probably a bigger effect is all the people who lost their jobs to covid. Domestic abuse always follows a large spike in unemployment

Unfortunately there was also a massive dip in reports because of schools not being in session.

Re: Parler Databases Disclosed

#23

Post by Benjmhart » Mon, Jan 11, 2021, 10:07 AM UTC

osgovernment wrote: post #9

aidenn0 wrote: post #7

Earlier quoted context omitted.

Probably a bigger effect is all the people who lost their jobs to covid. Domestic abuse always follows a large spike in unemployment

[flagged]

Cope harder loser.

Re: Parler Databases Disclosed

#24

Post by audunw » Mon, Jan 11, 2021, 10:11 AM UTC

fabian2k wrote: post #16

brobdingnagians wrote: post #11

Earlier quoted context omitted.

It appears Okta also banned them, they must have default succeeded instead of default fail, maybe an interaction between the two?: https://twitter.com/okta/status/1348191370528256002?s=20

That would be extremely careless, and I find it very hard to believe that this happened. An unlikely, but more plausible option to me would be that after removal of the Parler account, someone else was able to register the same account and gain access that way. But that doesn't fit the description all that well, and I'd also expect that this would not work at all if the authentication service is not very careless.

Maybe another explanation is that they quickly hacked around the lack of these services just to get things working again? I can imagine them quickly making a bunch of ill-advised code changes just to get their platform working.

Re: Parler Databases Disclosed

#25

Post by l33tbro » Mon, Jan 11, 2021, 10:12 AM UTC

atemerev wrote: post #21

Oh come on, it was a honeypot from the beginning. Everybody in the last few days was talking about Parler -- they got more exposure than ever in their life. The takedown from AWS was announced a few days before, so more users could register. Parler was running a "Verified Parler citizen" (wat?) campaign, to gather more personal data. And now, hackers conveniently exposed everything. Hackers are unpredictable, you kno…

I signed up to explore the site yesterday. Was curious from hearing in the news and it required an account to view. There was no verification process whatsoever. I popped in a fake email and then got immediate access. So not sure what this "Verified Parler citizen" thing refers to ...

Re: Parler Databases Disclosed

#26

Post by davedx » Mon, Jan 11, 2021, 10:15 AM UTC

neya wrote: post #4

"Twilio put out at midnight last night. In that Press Release, Twilio accidentally revealed which services Parler was using. Turns out it was all of the security authentications that were used to register a user. This allowed anyone to create a user, and not have to verify an email address, and immediately have a logged-on account. Well, because of that access, it gave them access to the behind the login box API that…

I would hold off judging Twilio based on a random anonymous reddit post's account

Re: Parler Databases Disclosed

#27

Post by mikewarot » Mon, Jan 11, 2021, 10:16 AM UTC

Udik wrote: post #13

neya wrote: post #4

"Twilio put out at midnight last night. In that Press Release, Twilio accidentally revealed which services Parler was using. Turns out it was all of the security authentications that were used to register a user. This allowed anyone to create a user, and not have to verify an email address, and immediately have a logged-on account. Well, because of that access, it gave them access to the behind the login box API that…

> Because Twilio was no longer authenticating emails. Can someone explain what does this mean?

It's basically the scenario Tom Scott laid out about what would happen if Google stopped checking passwords... except it happened to Parler.

https://www.youtube.com/watch?v=y4GB_NDU43Q

Re: Parler Databases Disclosed

#28

Post by yurgen228 » Mon, Jan 11, 2021, 10:18 AM UTC

I find it all hard to believe

Re: Parler Databases Disclosed

#29

Post by frollo » Mon, Jan 11, 2021, 10:19 AM UTC

l33tbro wrote: post #25

atemerev wrote: post #21

Oh come on, it was a honeypot from the beginning. Everybody in the last few days was talking about Parler -- they got more exposure than ever in their life. The takedown from AWS was announced a few days before, so more users could register. Parler was running a "Verified Parler citizen" (wat?) campaign, to gather more personal data. And now, hackers conveniently exposed everything. Hackers are unpredictable, you kno…

I signed up to explore the site yesterday. Was curious from hearing in the news and it required an account to view. There was no verification process whatsoever. I popped in a fake email and then got immediate access. So not sure what this "Verified Parler citizen" thing refers to ...

To get verified you had to post a scan of your driving license or another document, which was then stored in Parler's database. After all that happened (and even before 6/1 it was clear that Parler was being closely watched by a lot of three letter agencies), it was clearly a honeypot.

Re: Parler Databases Disclosed

#30

Post by uncledave » Mon, Jan 11, 2021, 10:19 AM UTC

atemerev wrote: post #21

Oh come on, it was a honeypot from the beginning. Everybody in the last few days was talking about Parler -- they got more exposure than ever in their life. The takedown from AWS was announced a few days before, so more users could register. Parler was running a "Verified Parler citizen" (wat?) campaign, to gather more personal data. And now, hackers conveniently exposed everything. Hackers are unpredictable, you kno…

It was funded by the Mercers so probably wasn’t a honey pot as they have interest in its business model as a primary cause.

It may have ended up as one intentionally anyway.