Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

Post reply on HN
Print view View original

61–70 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#61

Post by tnzk »

some_random wrote: post #6

>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.

> a publicly known phone number or email address

I don't get the definition of "publicly" here. Does it mean something on Internet, or include numbers I tell people in-person? If the former, not so many people put their number online I suppose...

Re: An incident impacting 5M accounts and private information on Twitter

#62

Post by spullara »

some_random wrote: post #6

>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.

You can remove your phone number after creating the account.

Re: An incident impacting 5M accounts and private information on Twitter

#64

Post by madars »

devmunchies wrote: post #58
some_random wrote: post #6

>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.

> you're forced to add a phone number to use twitter. is that true for the desktop web client?

Yes. They will let you sign up with just an email but after few minutes of activity your account will be locked and they will demand phone number verification.

Re: An incident impacting 5M accounts and private information on Twitter

#65

Post by jdmichal »

londons_explore wrote: post #5

I think you will see more of this class of attack. Lots of companies have various 'forgot my username'/'forgot my password'/'trying to sign up for a new account with a new email address but existing phone number'/'add a friend by email or phone' flows. It's very easy to accidentally leak some info that shouldn't be leaked while implementing such a flow, since you are peering into the users database querying by email/…

Yes. The proper way to implement this flow is to ask for the information, and then present the exact same result screen regardless of the actions taken. Any additional information or action should be done exclusively through the contact information you have on record.

Re: An incident impacting 5M accounts and private information on Twitter

#66

Post by voxl »

strulovich wrote: post #15
some_random wrote: post #6

>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.

It might have some PR speak sprinkled, but it’s genuinely good advice, put more bluntly: “We can screw up, if it’s important enough for you to stay anonymous you should get a separate phone number and email” That is a good tip with every company. If you want better security, have less trust in the services you’re using. This goes to what victim blaming is. Yes. It would be great if the victim lived in a better world.…

There is an exceptional difference you left out. In criminal situations, the criminal is punished, there is a deterrent. What is the deterrent here? Without a deterrent, there is a moral failure.

Re: An incident impacting 5M accounts and private information on Twitter

#67

Post by danbtl »

philliphaydon wrote: post #51
RL_Quine wrote: post #44

Earlier quoted context omitted.

Many "IOT" providers give physical numbers for almost no cost, and they provide physical SIM cards for the service. The aren't VOIP so aren't blocked by twilio, etc for use with Twitter and other services.

Any examples of providers?

Hologram.io or Twilio

Re: An incident impacting 5M accounts and private information on Twitter

#68

Post by [deleted] »

RL_Quine wrote: post #44
HowardStark wrote: post #39

Earlier quoted context omitted.

Would be super interested in hearing more about where you could find such a deal _with a physical SIM_. Seems far too good to be true.

Many "IOT" providers give physical numbers for almost no cost, and they provide physical SIM cards for the service. The aren't VOIP so aren't blocked by twilio, etc for use with Twitter and other services.

[deleted]

Re: An incident impacting 5M accounts and private information on Twitter

#69

Post by thaumasiotes »

trasz wrote: post #40
AlotOfReading wrote: post #26

Earlier quoted context omitted.

You need a plan to have a number because it's difficult/impossible to get a number allocated to you as an individual. If we assume "hundreds" means >=$200/year, then the maximum monthly payment we can have for that not to be true is $16/mo. The absolute cheapest phone plans I could find in the US that weren't for alarm systems were $15/mo on mvnos like mint. In practice, I suspect few people are paying less than $25-…

There are no prepaids? Which country do you have in mind?

Prepaid phone plans in the USA charge you a monthly rate just like subscription plans do. They may also charge you for usage, though that appears to have fallen off compared to the past.

Some years ago I looked into prepaid pricing and determined that it was significantly more expensive than a subscription plan at even my almost-never-use-it levels of phone use. (At that time, pricing was based on (1) a reasonable per-use rate, which would have been very cheap; combined with (2) a high flat fee charged on any day you used any feature of the plan, which already nullified any price advantage; and (3) a requirement to add funding to the plan every month, regardless of whether you had an existing balance.)

Re: An incident impacting 5M accounts and private information on Twitter

#70

Post by bena »

some_random wrote: post #6

>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.

I mean, originally twitter was an SMS based service. It was made for phones.
Post reply on HN