Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Parler Databases Disclosed

twitter.com

Post reply on HN
Print view View original

81–90 of 168 posts

Re: Parler Databases Disclosed

#81

Post by myaccount275 »

beerandt wrote: post #33
dgellow wrote: post #18

Earlier quoted context omitted.

Trying to make sense of it, I believe that means Parler was delegating their email verification and 2fa checks to Twillio. And somehow, without access to Twillio's API, they defaulted to not do any check at all? I'm not sure what to do of this, that doesn't sound that realistic but who knows.

That, or Twillio was reporting authenticated emails, without actually authenticating them? It seems to involve some skipped auth steps on someones part though, not just a fail-safe/fail-dead mixup. It's not clear.

Maybe Parler was deciding based on HTTP status codes returned from the Twilio API, or the presence of some expected "error" field in the response (if it's not there, consider it ok), and one side screwed up the handling of an unexpected case? Pure speculation.

Instead of having "if explicitly ok, proceed", they maybe had "unless it's an explicit negative response in an expected format (or a connectivity issue, timeout, etc.), proceed"?

Which would be a pretty dumb thing to do, but I've seen worse.

Re: Parler Databases Disclosed

#82

Post by cbozeman »

Traster wrote: post #66
Yetanfou wrote: post #45

If there is one lesson to be learned from these last few weeks it is that you can not rely on any external service if you do anything which goes against the dominant political narrative. I have never been on Parler's site so I can not check the veracity of their supposed implied or direct support for seditious acts but that does not seem to matter anyway, it is enough to stand accused to be considered a witch and bur…

> if you do anything which goes against the dominant political narrative I'm so tired of this. The reason people are getting banned from these platforms and services isn't because of just run of the mill political views. They're getting banned because they are hosting content calling for the violent overthrow of the US government. Apple didn't ban Parler from the app store for their attitude towards capital gains tax…

> direct threats of violence and calls to incite lawless action

And we see that every single day on Facebook and Twitter. Its against their terms of service, just like its against Parler's.

As a single entity, I don't really give a shit about Parler. What I do give a shit about is treating everyone fairly. If Parler goes because it has a shitton of users and can't swiftly police all content, then Facebook needs to go because they have a child pornography problem.

Listen to this podcast if you want to learn just how widespread the issue is: https://samharris.org/podcasts/213-worst-epidemic/

Re: Parler Databases Disclosed

#83

Post by kodah »

codefined wrote: post #5
kodah wrote: post #2

The description of the hack is not accurate. Okta is the service that disclosed the endpoints used.

Okta is a large, enterprise identity provider. I doubt in the case of a right-wing site existing they'd give out access to that provider on purpose? Did they mess up? I can't find any details about it yet.

I won't speculate on their intent, but by publicly commenting on disabling the account it looks like it opened the door for the hackers, again, if any of this is true.

It's entirely possible that Parler stored all of their data in S3, with metadata documents, and someone managed to find some creds in the app to list the object storage. These practices and this kind of vulnerability are both common.

Re: Parler Databases Disclosed

#85

Post by Aeolun »

rndholesqpeg wrote: post #72
Aeolun wrote: post #57

Earlier quoted context omitted.

I agree. As much as I feel it should be taken down, this has all the makings of a (corporate) lynch mob.

I guess you dont get the irony of using 'Lynch Mob' figuratively, because Parler was de-platformed for helping organize literal Lynch Mobs

No, I was aware of that. It was why I used the term.

It’s not the same at all, but it still leaves a bad taste in my mouth.

Legal action against the platform would have been fine.

Re: Parler Databases Disclosed

#86

Post by jdub »

traveler01 wrote: post #41

I don't know why but what's happening to Parler doesn't feel right at all...

Parler was set up by spivs and cranks to encourage fools and fascists to gather and destroy civil society. Now that same civil society has rejected them. Don't feel too bad.

Re: Parler Databases Disclosed

#87

Post by rbanffy »

neya wrote: post #4

"Twilio put out at midnight last night. In that Press Release, Twilio accidentally revealed which services Parler was using. Turns out it was all of the security authentications that were used to register a user. This allowed anyone to create a user, and not have to verify an email address, and immediately have a logged-on account. Well, because of that access, it gave them access to the behind the login box API that…

> this leaves a really bad taste with how Twilio handled the situation AS A BUSINESS.

I wouldn't blame Twilio. It's entirely Parler's fault they allowed an unvalidated account to successfully register and log in.

Of course, it's also entirely the intruder's fault they exploited the wide open security hole.

Re: Parler Databases Disclosed

#88

Post by [deleted] »

cbozeman wrote: post #75
AniseAbyss wrote: post #70

Earlier quoted context omitted.

Tech companies are shutting the Trump movement down because of public pressure. Its no different from any other boycott in that sense. Capitol Hill riot was the classic "free speech but not free from consequences" moment. Association with conservatives is now a financial liability.

> Association with conservatives is now a financial liability. Considering they make up an enormous percentage of the population, I'm not sure that's a sound strategic move.

[deleted]

Re: Parler Databases Disclosed

#89

Post by andromeduck »

cbozeman wrote: post #75
AniseAbyss wrote: post #70

Earlier quoted context omitted.

Tech companies are shutting the Trump movement down because of public pressure. Its no different from any other boycott in that sense. Capitol Hill riot was the classic "free speech but not free from consequences" moment. Association with conservatives is now a financial liability.

> Association with conservatives is now a financial liability. Considering they make up an enormous percentage of the population, I'm not sure that's a sound strategic move.

The left loves to defund/demonitize firearms content, the right nudity and lgbt content and both love deplatforming their opponents one moment and then get outraged if their stuff is removed the next. You see it with net neutrality, cda230, demonitization, forum moderation etc.

It seems people just don't care about consistency anymore, it's just whatever is convenient in the moment.

Re: Parler Databases Disclosed

#90

Post by rbanffy »

tutfbhuf wrote: post #36
dgellow wrote: post #18

Earlier quoted context omitted.

Trying to make sense of it, I believe that means Parler was delegating their email verification and 2fa checks to Twillio. And somehow, without access to Twillio's API, they defaulted to not do any check at all? I'm not sure what to do of this, that doesn't sound that realistic but who knows.

> they defaulted to not do any check at all? That would be a very unsafe default.

They wanted more users to register - they were urging users to invite friends and family - so they may have changed the safe default to the unsafe one thinking on verifying later without realizing the full consequences of what they did.
Post reply on HN