Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Parler Databases Disclosed

twitter.com

Post reply on HN
Print view View original

31–40 of 168 posts

Re: Parler Databases Disclosed

#31

Post by bmarquez »

l33tbro wrote: post #25
atemerev wrote: post #21

Oh come on, it was a honeypot from the beginning. Everybody in the last few days was talking about Parler -- they got more exposure than ever in their life. The takedown from AWS was announced a few days before, so more users could register. Parler was running a "Verified Parler citizen" (wat?) campaign, to gather more personal data. And now, hackers conveniently exposed everything. Hackers are unpredictable, you kno…

I signed up to explore the site yesterday. Was curious from hearing in the news and it required an account to view. There was no verification process whatsoever. I popped in a fake email and then got immediate access. So not sure what this "Verified Parler citizen" thing refers to ...

"Verified Parler Citizen" is basically a red badge to prove that you weren't a bot account. I think there were other benefits but I can't recall off the top of my head.

As a privacy-conscious person, the thought of uploading the front and back of a driver's license + selfie, or passport just to get an "I'm not a bot" badge is ridiculous.

Re: Parler Databases Disclosed

#32

Post by srwx »

l33tbro wrote: post #25
atemerev wrote: post #21

Oh come on, it was a honeypot from the beginning. Everybody in the last few days was talking about Parler -- they got more exposure than ever in their life. The takedown from AWS was announced a few days before, so more users could register. Parler was running a "Verified Parler citizen" (wat?) campaign, to gather more personal data. And now, hackers conveniently exposed everything. Hackers are unpredictable, you kno…

I signed up to explore the site yesterday. Was curious from hearing in the news and it required an account to view. There was no verification process whatsoever. I popped in a fake email and then got immediate access. So not sure what this "Verified Parler citizen" thing refers to ...

Prior to Okta and Twilio revoking their accounts you needed to provide SMS authorization to create an account (you give them a number, they send you a code, etc.). It seems likely after their API access to Okta/Twilio was revoked their services weren't written to catch and handle the new exception these API calls were probably raising...

Based on this twitter thread from Nov 2020 they may not have been hiring the best developers: https://twitter.com/davetroy/status/1327253991936454663

Re: Parler Databases Disclosed

#33

Post by beerandt »

dgellow wrote: post #18
Udik wrote: post #13

Earlier quoted context omitted.

> Because Twilio was no longer authenticating emails. Can someone explain what does this mean?

Trying to make sense of it, I believe that means Parler was delegating their email verification and 2fa checks to Twillio. And somehow, without access to Twillio's API, they defaulted to not do any check at all? I'm not sure what to do of this, that doesn't sound that realistic but who knows.

That, or Twillio was reporting authenticated emails, without actually authenticating them?

It seems to involve some skipped auth steps on someones part though, not just a fail-safe/fail-dead mixup. It's not clear.

Re: Parler Databases Disclosed

#34

Post by willejs »

This post seems fake. There was a group of people archiving the public content of parler using this docker container https://github.com/ArchiveTeam/parler-grab and archiving it here https://tracker.archiveteam.org/parler/.

I can't validate anything else in this twitter post. The administrator accounts part all seems fake, unless anyone has found the rest of the content or has a better source?

Previous discussion deeming its fake here https://news.ycombinator.com/item?id=25725268

Re: Parler Databases Disclosed

#35

Post by [deleted] »

atemerev wrote: post #21

Oh come on, it was a honeypot from the beginning. Everybody in the last few days was talking about Parler -- they got more exposure than ever in their life. The takedown from AWS was announced a few days before, so more users could register. Parler was running a "Verified Parler citizen" (wat?) campaign, to gather more personal data. And now, hackers conveniently exposed everything. Hackers are unpredictable, you kno…

[deleted]

Re: Parler Databases Disclosed

#36

Post by tutfbhuf »

dgellow wrote: post #18
Udik wrote: post #13

Earlier quoted context omitted.

> Because Twilio was no longer authenticating emails. Can someone explain what does this mean?

Trying to make sense of it, I believe that means Parler was delegating their email verification and 2fa checks to Twillio. And somehow, without access to Twillio's API, they defaulted to not do any check at all? I'm not sure what to do of this, that doesn't sound that realistic but who knows.

> they defaulted to not do any check at all?

That would be a very unsafe default.

Re: Parler Databases Disclosed

#37

Post by de6u99er »

neya wrote: post #4

"Twilio put out at midnight last night. In that Press Release, Twilio accidentally revealed which services Parler was using. Turns out it was all of the security authentications that were used to register a user. This allowed anyone to create a user, and not have to verify an email address, and immediately have a logged-on account. Well, because of that access, it gave them access to the behind the login box API that…

Hijacking top comment.

Here's the data: https://donk.sh/06d639b2-0252-4b1e-883b-f275eff7e792/

#noflylist is trending on Twitter. Guess a lot of jobs will soon be available in Silicon Valley.

Re: Parler Databases Disclosed

#38

Post by creato »

willejs wrote: post #34

This post seems fake. There was a group of people archiving the public content of parler using this docker container https://github.com/ArchiveTeam/parler-grab and archiving it here https://tracker.archiveteam.org/parler/ . I can't validate anything else in this twitter post. The administrator accounts part all seems fake, unless anyone has found the rest of the content or has a better source? Previous discussion dee…

The reddit post describing the hack mentioned creating "MILLIONS" of fake admin accounts: https://www.reddit.com/r/ParlerWatch/comments/kuqvs3/all_par...

Re: Parler Databases Disclosed

#39

Post by LarvaFX »

atemerev wrote: post #21

Oh come on, it was a honeypot from the beginning. Everybody in the last few days was talking about Parler -- they got more exposure than ever in their life. The takedown from AWS was announced a few days before, so more users could register. Parler was running a "Verified Parler citizen" (wat?) campaign, to gather more personal data. And now, hackers conveniently exposed everything. Hackers are unpredictable, you kno…

Yeah, sure buddy. Financed by the Mercers[1], are you kidding me.

[1] https://edition.cnn.com/2020/11/15/media/rebekah-mercer-parl...

Re: Parler Databases Disclosed

#40

Post by de6u99er »

willejs wrote: post #34

This post seems fake. There was a group of people archiving the public content of parler using this docker container https://github.com/ArchiveTeam/parler-grab and archiving it here https://tracker.archiveteam.org/parler/ . I can't validate anything else in this twitter post. The administrator accounts part all seems fake, unless anyone has found the rest of the content or has a better source? Previous discussion dee…

Check out my comment, below the top-comment in this post.
Post reply on HN