Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An incident impacting 5M accounts and private information on Twitter

privacy.twitter.com

Post reply on HN
Print view View original

101–110 of 479 posts

Re: An incident impacting 5M accounts and private information on Twitter

#101

Post by eli »

londons_explore wrote: post #3

So after forcing users to enter a phone number to continue using twitter, despite twitter having no need to know the users phone number, they then leak the phone numbers and associated accounts. Great. But it gets worse... After being told of the leak in January, rather than disclosing the fact millions of users data had been open for anyone who looked, they quietly fixed it and hoped nobody else had found it. It was…

Requiring a phone number is part of fraud & spam prevention. Maybe you'd make a different tradeoff but that's not "no reason."

Re: An incident impacting 5M accounts and private information on Twitter

#103

Post by hnburnsy »

HL33tibCe7 wrote: post #76

Can we have a proper postmortem about this please, with information about the exact process that was required to obtain this information? > We take our responsibility to protect your privacy very seriously and it is unfortunate that this happened. Patently not seriously enough.

here is the bug report...

https://hackerone.com/reports/1439026

Re: An incident impacting 5M accounts and private information on Twitter

#104

Post by coder543 »

WaitWaitWha wrote: post #27
londons_explore wrote: post #10

Remember that phone numbers are only 10 digits long, so brute forcing all phone numbers is totally doable. Considering that, if you implement any flow that involves checking if a phone number is already in use, then you are effectively leaking to an attacker a list of every phone number that uses your product.

In the USA. They range from 4 (St. Helena) to 13 (Austria), I believe.

St Helena changed to 5 digits nearly 7 years ago.

Re: An incident impacting 5M accounts and private information on Twitter

#106

Post by HL33tibCe7 »

So what you’re saying is that you discovered a vulnerability that leaked the private information of your users, said absolutely nothing for 6 months, then finally came clean, but only because you were forced to because people were selling data on the deep web.

Please take your “sorry” and shove it where the sun doesn’t shine. You don’t “take our privacy seriously”. This is utterly ridiculous and unacceptable, and in a fair world you would be punished heavily for it.

Edit: an earlier version of this comment criticised Twitter for not doing an investigation earlier to uncover the fact that a leak occurred. This accusation was based on me misreading the press report - see one of the child comments for details. I’ve removed that part of the comment.

Re: An incident impacting 5M accounts and private information on Twitter

#107

Post by jrockway »

londons_explore wrote: post #19
colechristensen wrote: post #14

Earlier quoted context omitted.

>countries where a phone number has an annual fee of hundreds of dollars. Is this a thing? I've never heard of it. Where?

It's true in the USA if you stick to the big providers... Ring up t-mobile and say 'I'd like a line with 0 minutes and 0 GB of data, just to receive verification texts for Twitter' and they'll probably quote you $200 a year or so...

Tracphone is the company you want for this sort of thing. A SIM costs $0.99 (requires unlocked phone of course) and you add $15 to the account to get 500 texts. (I think you can do this with cash at a place like Walmart.)

It is expensive if you need to keep the plan around, but Twitter doesn't seem to regularly send SMSes to the phone number, so you probably don't need to pay beyond the first month.

Re: An incident impacting 5M accounts and private information on Twitter

#108

Post by gojomo »

traceroute66 wrote: post #20
some_random wrote: post #6

>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.

> I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter. I had some old accounts that did not require a phone number. At least until I wanted to enable TOTP 2FA. At which point the numnuts at Twitter would not just let me "just" enable TOTP, I was forced to provide a phone number (which, to add insult to injury, for at long time they refused to accept because they would only s…

And then Twitter misused authentication phone numbers for marketing: https://www.ftc.gov/business-guidance/blog/2022/05/twitter-p...

And also used a sketchy service provider who was selling personal info about Twitter users to governments: https://9to5mac.com/2022/02/09/twitter-2fa-text-privacy/

Twitter has been habitually careless with user info & user privacy.

Re: An incident impacting 5M accounts and private information on Twitter

#109

Post by jrockway »

lynndotpy wrote: post #57
croes wrote: post #29

Earlier quoted context omitted.

But you can abandon a number after you registered on Twitter. Doesn't help against agencies but against scrappers

My very recent experience contradicts this. I removed my number and was immediately locked out until I added it back.

I don't think you tell Twitter that you canceled your cell phone contract. They don't need to know.

Re: An incident impacting 5M accounts and private information on Twitter

#110

Post by franklampard »

some_random wrote: post #6

>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.

> add a phone number

They do this to combat spammers, don’t they?

Post reply on HN