This twitter thread puts this in a bit different light, I think. https://twitter.com/davetroy/status/1327253991936454663?lang...
Parler Databases Disclosed
151–160 of 168 posts
Re: Parler Databases Disclosed
#152Earlier quoted context omitted.
> While it does feel reactionary (if that's the right word) that the services are only now revoking doing business with Parler, they are within their rights to stop the contract one-sidedly. I'm actually fairly sure that in the contract they don't even have to state a reason, but don't quote me on that. Yeah most of these services are doing that to avoid being associated with Parler and these Trump movements. But it…
You think that, democratically speaking, the majority of Americans are in favor of Parler conducting business? You think there should have been a vote or something? Amazon, Apple, etc don't work democratically though so it doesn't matter.
We just had elections, see how that went.
Re: Parler Databases Disclosed
#153Earlier quoted context omitted.
No, I was aware of that. It was why I used the term. It’s not the same at all, but it still leaves a bad taste in my mouth. Legal action against the platform would have been fine.
No judge would take the case though. Not from an ideological stand, but from a technical one. Amazon (presumably) has a contract that says they can nullify the contract if you do things that violate certain conditions. Say it was Amazon suing Parler here. Amazon says that Parler is doing stuff Amazon doesn't like. Parler says tough cookies, we're still gonna do that stuff. So Amazon brings Parler to court. The Judge…
I believe GP is referring to government legal action against Parler for "helping" organize lynch mobs. Extralegal retribution from oligopolistic service providers is of course also allowed by law, that just doesn't make it fine.
Re: Parler Databases Disclosed
#154I don't know why but what's happening to Parler doesn't feel right at all...
[dead]
Re: Parler Databases Disclosed
#155Earlier quoted context omitted.
> if you do anything which goes against the dominant political narrative I'm so tired of this. The reason people are getting banned from these platforms and services isn't because of just run of the mill political views. They're getting banned because they are hosting content calling for the violent overthrow of the US government. Apple didn't ban Parler from the app store for their attitude towards capital gains tax…
> direct threats of violence and calls to incite lawless action And we see that every single day on Facebook and Twitter. Its against their terms of service, just like its against Parler's. As a single entity, I don't really give a shit about Parler. What I do give a shit about is treating everyone fairly. If Parler goes because it has a shitton of users and can't swiftly police all content, then Facebook needs to go…
> just like its against Parler's.
Amazon and others asked Parler to remove content, they didn't. So they were removed from the service. If you want to lie or make up a defense for Parler please at least try a narrative that isn't false.
Re: Parler Databases Disclosed
#156This post seems fake. There was a group of people archiving the public content of parler using this docker container https://github.com/ArchiveTeam/parler-grab and archiving it here https://tracker.archiveteam.org/parler/ . I can't validate anything else in this twitter post. The administrator accounts part all seems fake, unless anyone has found the rest of the content or has a better source? Previous discussion dee…
[deleted]
Re: Parler Databases Disclosed
#157"Twilio put out at midnight last night. In that Press Release, Twilio accidentally revealed which services Parler was using. Turns out it was all of the security authentications that were used to register a user. This allowed anyone to create a user, and not have to verify an email address, and immediately have a logged-on account. Well, because of that access, it gave them access to the behind the login box API that…
The description doesn't really make any sense. Did everything just fail open? I would assume that if your SMS/Email service stopped working then it would just be that nobody could login or sign up.
> Did everything just fail open?
That seems to be the consensus.
Re: Parler Databases Disclosed
#158How would disabling Twilio disable authentication entirely? From what I see it is used to send SMS and maybe Email as well. So I could understand that it would prevent login, registration and password reset if that service is offline, but it shouldn't allow any of these without authentication. Unless the software skipped authentication entirely when this service was unavailable, which I find hard to imagine. But that…
They make a request to twilio and their logic checks for a failure response instead of looking for a success response. They are not getting back a different failure response and this causes the requests to be incorrectly be marked as success. For example here is how something like that might break: /auth -> returns {"success": true} and 200 on success -> normally returns {"success": false, "error": "BLAHLBAH"} and 20…
> the error could also be more obvious and the code just fails open. someone has a try/catch and returns true either because of an accidental mistake or because they don't want users to be locked out when the provider is down.
Failing open would be a catastrophic mistake either way. "The auth provider is down, just let everyone in!"
Re: Parler Databases Disclosed
#159"Twilio put out at midnight last night. In that Press Release, Twilio accidentally revealed which services Parler was using. Turns out it was all of the security authentications that were used to register a user. This allowed anyone to create a user, and not have to verify an email address, and immediately have a logged-on account. Well, because of that access, it gave them access to the behind the login box API that…
Tagging onto the top comment here. I work at Twilio and this is our official statement on the enforcement of our AUP with Parler.
---
With regards to reports of cyber security issues Parler experienced and have been attributed to Twilio, our security team investigated the claims and found no evidence indicating their security issues were related to Twilio or our products. Per our Website [0], Twilio has not issued any press releases pertaining to or referencing Parler.
Furthermore, Parler was using Twilio to send out identity verification codes for new downloads or password resets. Once a user was verified, security protocols were independently handled by Parler and did not involve Twilio or its products. On Friday, January 8th, we sent Parler a letter informing them they were in violation of our Acceptable Use Policy [1] and notifying them that we would suspend their account if they did not make efforts to remediate multiple calls for violence on their platform. Shortly after receiving our letter, Parler informed us they had already turned off their integration with Twilio.
Any cyber security issues experienced by Parler were completely unrelated to Twilio or any of its products.
Re: Parler Databases Disclosed
#160Can we get some better sources? This seems like an awful lot of hearsay, and there have been several comments from HN readers in this thread[0] and another[1] indicating that there is no public evidence to support these claims. Given that the author is alleging this is a crowdsourced effort, such evidence should be trivial to locate, but none has surfaced. [0]: https://news.ycombinator.com/item?id=25727332 [1]: https…
For those coming to the comments later, it was bullshit. No one from that group was claiming admin accounts were able to be created. Just that you could easily create regular accounts with a script because email verification wasn't required anymore. That original reddit explanation was mostly bullshit.
That so called technical person that knew much more than the poster apparently was misinformed.