The page isn’t loading for me and I notice Twitter itself is either slow or not loading at all right now. I also see a spike in reported problems for Twitter on DownDetector.
An incident impacting 5M accounts and private information on Twitter
111–120 of 479 posts
Re: An incident impacting 5M accounts and private information on Twitter
#112Can we have a proper postmortem about this please, with information about the exact process that was required to obtain this information? > We take our responsibility to protect your privacy very seriously and it is unfortunate that this happened. Patently not seriously enough.
here is the bug report... https://hackerone.com/reports/1439026
[deleted]
Re: An incident impacting 5M accounts and private information on Twitter
#113The page isn’t loading for me and I notice Twitter itself is either slow or not loading at all right now. I also see a spike in reported problems for Twitter on DownDetector.
[deleted]
Re: An incident impacting 5M accounts and private information on Twitter
#114>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.
I have yet to add my phone number to my account. My guess is that it isn't applicable for legacy accounts circa 2008.
It can be triggered for opaque reasons. My account dates to February 2007. I was prompted for a phone number a few years and given no other options to recover the account. Burner & VOIP numbers that work for many other things, including SMS verifications, were rejected.
I suspect the reason was some rapid changes in my IP address in a short period, together with a lot of Twitter tabs open – whose constant background requests often seem to trigger, for me, some sort of Twitter-side connection-slowing. (Their own shoddy, high-weight design makes my normal usage pattern look like a DoS attack to them.)
So your style of usage, moreso than your account age, is likely for being spared their arbitrary phone-number inquisition.
Re: An incident impacting 5M accounts and private information on Twitter
#115The page isn’t loading for me and I notice Twitter itself is either slow or not loading at all right now. I also see a spike in reported problems for Twitter on DownDetector.
It loads for me in the browser, but the app is failing to load data.
EDIT: A few refreshes shows it's slow and occasionally failing in the browser for me...
Re: An incident impacting 5M accounts and private information on Twitter
#116> When we learned about this, we immediately investigated and fixed it. At that time, we had no evidence to suggest someone had taken advantage of the vulnerability. > In July 2022, we learned through a press report that someone had potentially leveraged this and was offering to sell the information they had compiled. After reviewing a sample of the available data for sale, we confirmed that a bad actor had taken adv…
"We have no evidence that this was exploited" is a standard psychological trick they pull in vulnerability announcements to give an unfounded impression that it hasn't been exploited.
"an absence of evidence is not evidence of absence"
Isn't that taught in..uh..I dunno, middle school science class?
Just because you don't see the rabbit, doesn't mean it doesn't exist.
Re: An incident impacting 5M accounts and private information on Twitter
#117>If you operate a pseudonymous Twitter account, we understand the risks an incident like this can introduce and deeply regret that this happened. To keep your identity as veiled as possible, we recommend not adding a publicly known phone number or email address to your Twitter account. I'm so sick of this kind of victim blaming, you're forced to add a phone number to use twitter.
They seem to be recommending that you use an unlisted phone number. That seems like a good idea.
To some privacy threats, essentially no numbers are "unlisted".
Re: An incident impacting 5M accounts and private information on Twitter
#118Earlier quoted context omitted.
There are no prepaids? Which country do you have in mind?
Prepaid phone plans in the USA charge you a monthly rate just like subscription plans do. They may also charge you for usage, though that appears to have fallen off compared to the past. Some years ago I looked into prepaid pricing and determined that it was significantly more expensive than a subscription plan at even my almost-never-use-it levels of phone use. (At that time, pricing was based on (1) a reasonable pe…
Wow, the prepaid plans in your country suck.
How they work here is:
1. You need to top up by €20 at least once a year to keep your account
2. You may sign up to an offer, which will deduct a portion of a top up each month to activate the offer (e.g top up by > €20, the phone company takes €10 for unlimited texts, or €20 for unlimited data).
3. If you don't top up as required by your offer, you fall back to a state as if you had no offer
4. If you have no offer there's fixed fees of like 20c/sms and €0.50/min of calls, €2/day for 100mb of data
Re: An incident impacting 5M accounts and private information on Twitter
#119Earlier quoted context omitted.
Given they didn't think it was exploited they must have pretty poor logging and analytics around that part of their infrastructure. Someone managed to abuse it millions of times and they didn't know about it even after they'd fixed it and knew exactly where to look for abuse.
Curious what kind of logs/analytics would you add and watch to catch something like this?
You should notice a spike in any request logging metric if someone exploits this.
Re: An incident impacting 5M accounts and private information on Twitter
#120And why does anyone still use twitter? Its a cesspit and they ALWAYS have some kind of security issue going on. Nothing of this magnitude, but still.