21–30 of 479 posts
>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.
> In January 2022, we received a report through our bug bounty program > This bug resulted from an update to our code in June 2021 Does this mean the problem existed for 7 months and nobody at Twitter noticed until they received a bug report?
>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.
>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.
Yeah, it's shocking they would say this when they do require phone numbers in many instances.
Earlier quoted context omitted.
No mention of that fact that 'use another phone number' is quite an expensive thing to do in countries where a phone number has an annual fee of hundreds of dollars. Suddenly 'use twitter securely' has gone from 'free' to 'hundreds of dollars a year'. Perhaps they should announce this as a price change instead?
>countries where a phone number has an annual fee of hundreds of dollars. Is this a thing? I've never heard of it. Where?
Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.
They range from 4 (St. Helena) to 13 (Austria), I believe.
Earlier quoted context omitted.
>countries where a phone number has an annual fee of hundreds of dollars. Is this a thing? I've never heard of it. Where?
It's true in the USA if you stick to the big providers... Ring up t-mobile and say 'I'd like a line with 0 minutes and 0 GB of data, just to receive verification texts for Twitter' and they'll probably quote you $200 a year or so...
Earlier quoted context omitted.
It might have some PR speak sprinkled, but it’s genuinely good advice, put more bluntly: “We can screw up, if it’s important enough for you to stay anonymous you should get a separate phone number and email” That is a good tip with every company. If you want better security, have less trust in the services you’re using. This goes to what victim blaming is. Yes. It would be great if the victim lived in a better world.…
In Germany and other countries you have to show government ID to get a GSM number. Phone numbers are like bank accounts: strongly linked to official name and identity. This advice is bullshit.
Earlier quoted context omitted.
It's true in the USA if you stick to the big providers... Ring up t-mobile and say 'I'd like a line with 0 minutes and 0 GB of data, just to receive verification texts for Twitter' and they'll probably quote you $200 a year or so...
$120 before tax for T-mobile for 1000 minutes, 1 GB/mo.